Behavioral task
behavioral1
Sample
7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0.exe
Resource
win10v2004-20240611-en
General
-
Target
7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0
-
Size
2.8MB
-
MD5
f25a1d234ea5cd6094cf8234e306278a
-
SHA1
b528c63be6ab62075aee2ed8dc7ff89927cbd3ae
-
SHA256
7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0
-
SHA512
9034016095a307b97aa12feae7a0593915a399a00cefae628f17d846484ca0222d7082b1048997ded2293ddea067576acbfa5fd5f834285d01a814464bec8b28
-
SSDEEP
49152:GooEvqmT+pIQRXsi/MAW+V7RB+KuB52DwL+Iq5e7MjbK4ufpqIPpqY2J7FBiKiHB:GooEvZypIX4lw52vCMqJfwIPp4HIKMig
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0
Files
-
7623b8ab94808a2b3ae48d90aa7075b02a905f6ef8f708141c9fa54d717f5ec0.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ