Behavioral task
behavioral1
Sample
26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe
Resource
win7-20240705-en
General
-
Target
26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb
-
Size
71KB
-
MD5
aff0802cac47b83b4bbbd866712d0781
-
SHA1
e63e8b1717bbfedafde9b7b302892353cf98095c
-
SHA256
26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb
-
SHA512
03836687d3ca18d080098c923b6560a6a2f6d8d0ace198d47a42399d64b5d83bf8d77b02aa72f864b49c8f92c8f1ccec91dfc0b015eff2b17e1a7e7a43112d13
-
SSDEEP
1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:JdseIOMEZEyFjEOFqTiQmQDHIbH
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb
Files
-
26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE