Behavioral task
behavioral1
Sample
386d7770384dffae99a3b6ab94298f40_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
386d7770384dffae99a3b6ab94298f40_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
386d7770384dffae99a3b6ab94298f40_NEAS
-
Size
301KB
-
MD5
386d7770384dffae99a3b6ab94298f40
-
SHA1
3f6c92803b63d95e888dfd0edc3c859fea0a621d
-
SHA256
8c2e0b92c29973a042902858a8ae575391143923824785e4d66f87d88e5445b4
-
SHA512
3d2df47826a2e1e53a3cccf6062ea5db554b591e53ecad7b0a442c53d5759821f0487948c64cd299f24f56b64a17f5a001f531c0c468c69b466b87d2acbcd4af
-
SSDEEP
6144:gjluQoS3Io5RuT3lx79ruy+bjGCKxBGM78nROYxBZ5O+:gEQoSh6xruDbjSPQnROYxLl
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 386d7770384dffae99a3b6ab94298f40_NEAS
Files
-
386d7770384dffae99a3b6ab94298f40_NEAS.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gtcl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kxvu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.psfx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oncez Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bsp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ