NEAS[.]aee4ae7e35e51e06b66109f292ecfc30[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.aee4ae7e35e51e06b66109f292ecfc30.exe
Size

248KB
MD5

aee4ae7e35e51e06b66109f292ecfc30
SHA1

c8adeff606f8a04d6c41c214212ab75c7ac26da7
SHA256

8b68ef24ade1620d6ee3ad4577a7ec69cbd8c21d5750b708752159c75de58792
SHA512

37f71234eea93a25a67582e7eee00bd964b35e2edcfb165717050d219428b8baa6b0116cf5c001f0dab5df739139d76b3e0f8b29f2f6d45c60ed99b55f38c55b
SSDEEP

3072:mSVMfMIbIaw3J9MQ9lB+BC3K5eqU+BC3K5eqYroGAyfYpTqj:mnfMmM2yK70K7O1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.aee4ae7e35e51e06b66109f292ecfc30.exe

Files

NEAS.aee4ae7e35e51e06b66109f292ecfc30.exe
.exe windows:1 windows x86

120c163627f56634f6f1cf5ddfc80997

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
SetLastError
GetModuleHandleW
lstrcpyW
lstrcmpW
lstrcatW

crtdll

__GetMainArgs
exit
raise
signal

framedyn

?Compare@CHString@@QBEHPBG@Z

iphlpapi

GetAdaptersInfo

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE