Behavioral task
behavioral1
Sample
46e0b85048cc2cccf46331753f975c55.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
46e0b85048cc2cccf46331753f975c55.exe
Resource
win10v2004-20231222-en
General
-
Target
46e0b85048cc2cccf46331753f975c55
-
Size
168KB
-
MD5
46e0b85048cc2cccf46331753f975c55
-
SHA1
35138c911832ef7f51ee6ce07fc3bbdb2d930637
-
SHA256
6dce7892d35cea39081b36d4119af8478c7d8eb17205c6e729ad52c66a830161
-
SHA512
c27f4f6884dd9a767ef900cc91ba60b3f680283a42fc6a7553c70513a12be01d8740bec018075761564258f7d614d0049be04fa4682d8f9d2225b90834f84992
-
SSDEEP
3072:bBPuuaE1RCQEW0tMxNiCHH18wDGdf3sdv0tEt7v0tEtcg67r85C:bBGuaELCLDtM6CHiwyBO8tEt78tEtc9
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46e0b85048cc2cccf46331753f975c55
Files
-
46e0b85048cc2cccf46331753f975c55.exe windows:4 windows x86 arch:x86
45298c1c501db2a9f2279f628351e528
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
bind
WSACleanup
gethostname
inet_ntoa
getservbyname
getpeername
gethostbyname
getsockname
ntohl
sendto
select
recvfrom
recv
connect
accept
listen
htons
closesocket
socket
setsockopt
__WSAFDIsSet
WSAStartup
ntohs
htonl
WSAGetLastError
ioctlsocket
send
user32
FindWindowA
DrawMenuBar
GetSystemMenu
DeleteMenu
kernel32
GetTimeZoneInformation
WideCharToMultiByte
LCMapStringW
GetSystemTime
GetLocaleInfoW
GetLocaleInfoA
LCMapStringA
CreateFileA
ReadFile
SetEndOfFile
GetStringTypeW
GetStringTypeA
SetStdHandle
GetLastError
SetPriorityClass
GetCurrentProcess
SetConsoleCtrlHandler
SetConsoleActiveScreenBuffer
CreateConsoleScreenBuffer
SetConsoleTitleA
AllocConsole
GetModuleFileNameA
TerminateThread
FlushConsoleInputBuffer
ReadConsoleInputA
GetNumberOfConsoleInputEvents
SetConsoleMode
GetConsoleMode
GetStdHandle
CopyFileA
GetVersion
GetWindowsDirectoryA
WriteConsoleA
GetTickCount
Sleep
CreateEventA
CreateMutexA
ReleaseMutex
WaitForSingleObject
ResetEvent
SetEvent
WaitForMultipleObjects
CloseHandle
GetUserDefaultLangID
GetCommandLineA
GetLocalTime
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
ResumeThread
CreateThread
TlsSetValue
ExitThread
TlsGetValue
GetCurrentProcessId
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
DeleteFileA
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
SetLastError
CompareStringW
SetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
FlushFileBuffers
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
SetFilePointer
CompareStringA
advapi32
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
StartServiceCtrlDispatcherA
CreateServiceA
OpenSCManagerA
OpenServiceA
ControlService
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ