Behavioral task
behavioral1
Sample
b6d2670c50b59980eebfe1fa54a60a20_NEAS.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b6d2670c50b59980eebfe1fa54a60a20_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
b6d2670c50b59980eebfe1fa54a60a20_NEAS
-
Size
1.6MB
-
MD5
b6d2670c50b59980eebfe1fa54a60a20
-
SHA1
ee2734808762127bcdedbae7806256c24c88af15
-
SHA256
9f717b111ae156e5806ca5026c2081ca251dc35bd7132304d1ecf9caf505ccf8
-
SHA512
0a9b2aa47fbbfbe29991225503cd3914e2b5c470b7cb804659a8391e3c94315ab9196eab20c856b60b400dac66cb3035552692da1d7ea99c1b43bb80db2b7eac
-
SSDEEP
49152:XZPG3alF6cWlKwCgS8MCYHxvXvPz7RO9mJwVTo32Am:XZO3al8cWPCiMtRvXvPz749mJ8Ao
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6d2670c50b59980eebfe1fa54a60a20_NEAS
Files
-
b6d2670c50b59980eebfe1fa54a60a20_NEAS.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ktlju Size: 4KB - Virtual size: 4KB
.wu Size: 512B - Virtual size: 4KB