neshta | 87e5b356702c29e76cce95a137d1ea72_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

87e5b356702c29e76cce95a137d1ea72_NEAS
Size

360KB
MD5

87e5b356702c29e76cce95a137d1ea72
SHA1

f05f501c505fd0e67be2da72a17877ea7c3474bf
SHA256

76413a804107edf89443391767e152cbfca49ec48900c407fdaf9e307a3f567e
SHA512

a41fb578aacb069ad7249f69a3fb1b4e13aa59a3a92d3e8fa790827b0ec522c34849458017078c13c23fc2bf5f26c6c23289219c848e3a6c8f629ef29a7ff471
SSDEEP

6144:k9ZjStNDaV7rF+cn9I5K+hxUP0RGRaEAInjBfakxuz38SVeOTLe:0t7rF+8GzQZaEAInjBfakxuz38SVeOne

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87e5b356702c29e76cce95a137d1ea72_NEAS

Files

87e5b356702c29e76cce95a137d1ea72_NEAS
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ