NEAS[.]3a868be8de80c6ff620484ab2d3df980[.]exe | Triage

Sharing

General

Target

NEAS.3a868be8de80c6ff620484ab2d3df980.exe
Size

96KB
MD5

3a868be8de80c6ff620484ab2d3df980
SHA1

2e32c0020ccbdd15dac7d40a849bc36a589ab5d9
SHA256

78eb7ef36f42d6756cec5a22f967b7533d1951fc47465c01753940024b697a1c
SHA512

18115dc2a87ffeb9701c189ee8d781dc8968245a8350d7c95630c8c53f7193b4a49f2a89a1b6485a2b985e3d6be8f0418143f732bb819a5cb747309a34ed1f06
SSDEEP

384:4cFwbRbw370AYoID1fb8JDFwbRbw370bsEm:4c2bRb65KKJD2bRb6U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3a868be8de80c6ff620484ab2d3df980.exe

Files

NEAS.3a868be8de80c6ff620484ab2d3df980.exe
.exe windows:5 windows x86 arch:x86

98ecfc6f04d7bc5614005b07fa36ab8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
ReadFile
ExitProcess
GetTickCount
GetModuleFileNameW
VirtualFree
VirtualAlloc
lstrlenA
CloseHandle
CreateFileW

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext

ntdll

_wtoi

ole32

CreateStreamOnHGlobal

user32

wsprintfA
wsprintfW

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpQueryHeaders

Sections

UPX0
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE