Behavioral task
behavioral1
Sample
e8bc57ec92bfd156c751cc428421a980N.exe
Resource
win7-20240903-en
General
-
Target
e8bc57ec92bfd156c751cc428421a980N.exe
-
Size
71KB
-
MD5
e8bc57ec92bfd156c751cc428421a980
-
SHA1
b79a98ab810c9675e75cc4ff4b5461627ba54032
-
SHA256
8f2e47fd34f18c824d97dd56c8bb1f02f0e7ef2ef9c730aa4fe558b2f822359f
-
SHA512
eaed64ae0a16fb98d91f1595288879b81dd6188af7163119eb872a1a66b2f1ce014aa4fbf1aee70221c06da1027299e893460bdff794803a1f17437014559cd3
-
SSDEEP
1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:XdseIOMEZEyFjEOFqTiQmQDHIbH
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8bc57ec92bfd156c751cc428421a980N.exe
Files
-
e8bc57ec92bfd156c751cc428421a980N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE