neshta | 233e06fc53bfc40bc3082ba7286a7d60_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

233e06fc53bfc40bc3082ba7286a7d60_NEAS
Size

889KB
MD5

233e06fc53bfc40bc3082ba7286a7d60
SHA1

c8cb13d7447e6a6c411e5a8b4747f45f546ab72c
SHA256

c342e31bd7b2fabc71238b27ed404a4fef1155ae23b29584aa8a4133346a4d82
SHA512

1e2d46c3ade132efcc0ab9e926e52071fe7077ebb2c6536d838af43404745d3aae1af40669a5eaead20ef1c06f6da728aacaf15ce50e5d1b333ff1edd75c746a
SSDEEP

12288:FRKzW1S2ZBDCULVW+GrSy63NPr1L3h8OVSoQ79K4dFFZSj43C8h3iFK:FRKzESC85ey6dl3OOVS9KyMqdiFK

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
233e06fc53bfc40bc3082ba7286a7d60_NEAS

Files

233e06fc53bfc40bc3082ba7286a7d60_NEAS
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ