Behavioral task
behavioral1
Sample
ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156.exe
Resource
win10v2004-20240419-en
General
-
Target
ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156
-
Size
114KB
-
MD5
43a9039e43d3f21870cff02e4141aea8
-
SHA1
147b40db9c81643dae17cac0c48dfde69ed77eaa
-
SHA256
ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156
-
SHA512
9003dc92880c15ded43f5c9e192826ed38874f1d94bd531eba9b17c182b7370afa2181bd147794e68bbc47bb0fe88b6ed24fb5f2c5f2ff51a3cb508acea54a86
-
SSDEEP
1536:JxqjQ+P04wsmJC/Vk5rg1cRla/VGsNErGclxsQTUkwsqOsKgKSk9nH9lEm8/twAD:sr85CmZg1c3a/bSGVQTLsxKSklHEbtfD
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156
Files
-
ba19949ea49be9550044a0a8c714de834d0de256da4342134a3e32796e0a7156.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ