Behavioral task
behavioral1
Sample
3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704.exe
Resource
win10v2004-20240508-en
General
-
Target
3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704
-
Size
4.0MB
-
MD5
f309041f3c1ff7c70a6082a5586582d2
-
SHA1
46c8f707d8cf3010a493b9be3657d6cbb136ef18
-
SHA256
3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704
-
SHA512
cba8b1ab496b74ff4649f13ed1a7336ddd9832950ab16d9a1248002a04d80e106eec021174fd8d2e611c272641f9b79c417da9a9294f5f4978c0903d5864c90d
-
SSDEEP
98304:Pnsmtk2abmtk2a/mtk2agmtk2asmtk2a0n6n1ndn9:fL73S2h0JB9
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704
Files
-
3345d5b943b957220234857eabbe7fc567155bc114a2dc5d95c37d5adcfe7704.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 615KB - Virtual size: 614KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 57B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ