neshta | 3ad49863356d9b6df02941896bb22950N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ad49863356d9b6df02941896bb22950N.exe
Size

1010KB
MD5

3ad49863356d9b6df02941896bb22950
SHA1

cb280a93bfe48f6a14f6f7a032b7c7af1fa09def
SHA256

b84446155e3b9b72f46d6bb7d197caf75dd1a228a2b0ae337d29fa4e3661ffc0
SHA512

0cf0083d16b49a8fe1b4fd1f0803a3134bd043b37bc9d54c3bfdb462c72d2af75ae9db344d336f846aa785fca73df3583c49c64ea2bccb958cbe5e7366da37ed
SSDEEP

24576:gtfSmPeA8VEVNSL2GucHsnGKUnYFxWuxOGSrIxtXHq:gtfT2VmNSLtHsGKUnywuOrIzXq

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ad49863356d9b6df02941896bb22950N.exe

Files

3ad49863356d9b6df02941896bb22950N.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ