Behavioral task
behavioral1
Sample
NEAS.5f36106ae976614b01dec6ce4c893890.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.5f36106ae976614b01dec6ce4c893890.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5f36106ae976614b01dec6ce4c893890.exe
-
Size
9.6MB
-
MD5
5f36106ae976614b01dec6ce4c893890
-
SHA1
523382d0075548f161702ee93bcdeba764a59c5c
-
SHA256
ef6f8750d100399ea2eca49435b63e91ac8752e40bc0e7ecc43a51ea8aedbc09
-
SHA512
edadb38a41f5f559bdce953ef4d768194b8eeac34867ac9b54b549ccf53ddda4f4a4cae0207f2050482ecdb5bf7466bbf3a7f4261db68724d40dc2645aa2dd87
-
SSDEEP
98304:749k9LhJvqWLSYAo30t2/ZwumpEja52nQrmZKUBEOxp6+9d54rVOXNCEIZplkskY:LNBqMXSsQrmZKU3xdd54r0qnkJAO+
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.5f36106ae976614b01dec6ce4c893890.exe
Files
-
NEAS.5f36106ae976614b01dec6ce4c893890.exe.exe windows:5 windows x86
88381b84da56810b869e897e6d45bd58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
EnumChildWindows
Sections
UPX0 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 894KB - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.main Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE