3069b7398949b1b214726a87c3841ec0_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3069b7398949b1b214726a87c3841ec0_NEAS
Size

125KB
MD5

3069b7398949b1b214726a87c3841ec0
SHA1

80725dcd03421e351814fdd3383a93c0addcf0d2
SHA256

cfe1607c1e94a7e8fc64583aa6b0cd1f06f7d0eb813932b6e0010ebd97a4ebf1
SHA512

ae4c2069a69b61e49a309b8c1a111c9bd116dbfe02770951347f8adafd1b01c61f2f5c69c4a5574462398704ea379e90a2c604dc67c8a65513495a56e1524dfd
SSDEEP

3072:q8ZCvutdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7Zsu3:qxvutdgI2MyzNORQtOfl1qNVo7R+S+N3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3069b7398949b1b214726a87c3841ec0_NEAS

Files

3069b7398949b1b214726a87c3841ec0_NEAS
.exe windows:4 windows x86 arch:x86

3db2c1aad06d38a08f2119d789a12991

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
CreateFileA
GetLastError
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
lstrcmpA
lstrlenA
GetTickCount
GetCurrentProcessId
GetCurrentProcess

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject

user32

SendMessageA
ShowWindow
MessageBoxA
PostQuitMessage
GetMessageA
EndPaint
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
DestroyWindow
LoadIconA
UpdateWindow
LoadCursorA

Sections

UPX0
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE