Behavioral task
behavioral1
Sample
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c.exe
Resource
win7-20241010-en
General
-
Target
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c
-
Size
2.8MB
-
MD5
6f416a2a05246c3049ea9070e28e01d3
-
SHA1
506e664bf51923b3e784d235807d2aa88b812251
-
SHA256
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c
-
SHA512
b575b89f4fe815ea0055e1f94502ee8f0127142755e4b8feeb56f0891c4e87d011b06da46d1dfdced3b17951efe5ee5dfc36e225634e3f8f75565fbfb86f48f6
-
SSDEEP
24576:xwPKcqaCbuHDZS2Xqbzsbx+80kL1y4/pCb9vEYhqKDhQBz8NA66W8MXPnAhnAGnb:yv7Cq1SfzIx+4JdWEim8ALWXXYWbbbW
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c
Files
-
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 424KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 48KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uro Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE