neshta | d407fd274318e7263f7879a8d176d810N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d407fd274318e7263f7879a8d176d810N.exe
Size

608KB
MD5

d407fd274318e7263f7879a8d176d810
SHA1

f55540132d211b59f3df0cbc1c1a5292803c6065
SHA256

3c2a4645bfc381412ef1afe40e12d176012784a24e2b8b2e59640b2199a81ed9
SHA512

76f1052e9fd266c77e14514a5c096264904c44b0b8c6686e3354a77153f8eefae8e84772d9502375263ec0c912c4c8ad84f2dbd3925cec9f1ac17fbb96108fb4
SSDEEP

12288:CB0JfiwSdYSui8zZH94I3H1v11L2dFEn0qF7z4:CsfiTdYSuVzZH9tH1v11yFMR4

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d407fd274318e7263f7879a8d176d810N.exe

Files

d407fd274318e7263f7879a8d176d810N.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ