0461e6e8f234e00307331dae19d3512950bbf3cdf7a1ec32802dff62cc14c90c.zip
- SHA256 0461e6e8f234e00307331dae19d3512950bbf3cdf7a1ec32802dff62cc14c90c
Behavioral task
behavioral1
Sample
0A6172B017F62EAA.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0A6172B017F62EAA.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 0461e6e8f234e00307331dae19d3512950bbf3cdf7a1ec32802dff62cc14c90c.zip
- Size 562KB
- Sample241202-flyd5s1jex
- SHA256 0461e6e8f234e00307331dae19d3512950bbf3cdf7a1ec32802dff62cc14c90c
- MD5 be8d17952bcdf0bac1696e7f9d4fc337
- SHA1 902f122bf960a82331505e82c143af91424db1fd
- SHA512 79aea791aa8a43ae88bbb27501f09f16b6f63165481b4faa7357a3f037b59a012ec0444954df41f39eadcc02a1d77d34d17eafaad46b55b023e52f61e0950e84
- SSDEEP 12288:7Mgw/UcFZJP2zC7ttD0ZgDn/rvPxemsMgw/UUZJP2z/jrEL0cAB3:7M2cF2zQpCgnc/M2U2znELHAB3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 1 IoCs
resource yara_rule static1/unpack001/F5657AC3DC58DC8C.exe family_neshta - Neshta family
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/0A6172B017F62EAA.exe unpack001/2891E1D4BAC70EBA.exe unpack001/3472CB2D1AB89AAB.exe unpack001/613788884CE0093F.exe unpack001/7189AED8B8AE6568.exe unpack001/CC3B1F89FAA517E4.exe unpack001/F5657AC3DC58DC8C.exe
File Explorer
-
0461e6e8f234e00307331dae19d3512950bbf3cdf7a1ec32802dff62cc14c90c.zip.zip 562KB
-
0A6172B017F62EAA.exe.exe 137KB
-
2891E1D4BAC70EBA.exe.exe 137KB
-
3472CB2D1AB89AAB.exe.exe 137KB
-
613788884CE0093F.exe.exe 137KB
-
7189AED8B8AE6568.exe.exe 137KB
-
CC3B1F89FAA517E4.exe.exe 137KB
-
F5657AC3DC58DC8C.exe.exe 177KB
0A6172B017F62EAA.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 a75d6bf3c8cf0fc45b368bd83200d141319c9c67033803a230bd3451a309edff
- MD5 b556893d6f0219bb98468f724aeb06cf
- SHA1 540d6c29aa4a05564da6bf253fc46fc8793277f1
- SHA512 3a9c8477dfec35af9e682e197c76a1c1e341cdd4f4c276d1c18beac9ff5b53da394eac8428e66921369a607cd75c2fb7e430466758df508d6974e59f7f901ae9
- SSDEEP 3072:MLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8hn2bIoKb:MstYrEMw6Bxk5zOFNtgJiCUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
2891E1D4BAC70EBA.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 207a249e3c4359548b9ff264cac31d09c95d626d0e4835c081d8afbb732bac4f
- MD5 c04dadf78f2813750900fa54863fb2b7
- SHA1 8575e9d6f980b53ea13c37053aa2d55691bfe3e0
- SHA512 20baf3958a55df7fe0196d300809afd2c4d4408c4e08db21f5ed6a1b6d21fcb09eea081813cf2b5ba60d745f745db043d2d2d9132da3ea565306402247b43372
- SSDEEP 3072:GLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8hv2bIoKb:GstYrEMw6Bxk5zOFNtgJKCUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
3472CB2D1AB89AAB.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 ba6a4d65b25c86faa7179d1aa3db48c2fc445e393d1b8c0035dbd81d27b93d54
- MD5 cdb5b9402d4db31b15abd8dd2eb1947d
- SHA1 912c9ac3addd53685b3409c46dcb73946a74ecd3
- SHA512 50280c0dc4e6d2709d2f18ff77134e029d1a123a5fcb173fab5fc4cd164b64d5b168b6286f39f6d5be7b0dcd140550692963d4fd08577a79682a833d6a6f8619
- SSDEEP 3072:PLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8hj2bIoKb:PstYrEMw6Bxk5zOFNtgJOCUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
613788884CE0093F.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 ecd80e30e6bae14ca7c1198e430651aa297e01361a0508acef591adc0d50159b
- MD5 0b6d033622c9ff929e98c5ef7e2f8860
- SHA1 ece019cdcbfab97462461585c58a5cf62bc5deb6
- SHA512 a5308bab575e87825cef01ae01ed8da84e1d42e588509b7bda1e8f4ffadc5fcbb39b9c5d6a331d508d74c12ba077cb303706537cb15662076a1fde86106b73e6
- SSDEEP 3072:hLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8h32bIoKb:hstYrEMw6Bxk5zOFNtgJ6CUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
7189AED8B8AE6568.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 c2fc050f33d51d5560da425d137ef1e318f16fe5d49ee894327e33c3e12755e3
- MD5 ff7559d2160f6732056ff5a19722e69a
- SHA1 aed67bf0c6e521fc552cbb4afe24a1c2eb286da7
- SHA512 020825f085dc4b08f2454be5425cd937a1f146843b76b445c6d5993d0581fedf93f84742e64b2abe986a8d5803a62a597962a04821488dea771c5354b6dfda10
- SSDEEP 3072:oLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8hb2bIoKb:ostYrEMw6Bxk5zOFNtgJGCUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
CC3B1F89FAA517E4.exe
- IMPHASH 5faa97909af8129b66dff3dd95bb8fb1
- SHA256 ed4e298040946a3be24dcde8303216644c2d2b78444bb1c9bfc7d17c748aeaa5
- MD5 4aed4c0e78d355e497f2cc509ff078b5
- SHA1 31a2ccfd5a679d2badc5fb66f243d4887d9ca444
- SHA512 bb251af369bd2662caef94ee96147439a75307dbfc30e2b2a63fad75af597e7981c41daec8cedb4326fb0243abbce2b681153380ccec79a38095022b85d4a804
- SSDEEP 3072:CLIQ8YzXEMZK1A2czbFk58x+o+EFz9/t2f65q8hv2bIoKb:CstYrEMw6Bxk5zOFNtgJSCUb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSection
SetFilePointer
CreateFileW
lstrcatW
CloseHandle
GetLocalTime
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetFilePointerEx
LocalFree
MoveFileExW
GetCurrentProcessId
CreateIoCompletionPort
GetDriveTypeW
SetConsoleCtrlHandler
GetConsoleWindow
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
GetCommandLineW
GetQueuedCompletionStatus
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=143, id=261, version=25711,
count=18, id=260, version=25711,
count=18, id=259, version=33731,
count=18, id=260, version=33731,
count=37, id=261, version=33731,
count=13, id=257, version=25711,
count=130, id=1, productName=Unmarked objects,
count=10, id=265, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
F5657AC3DC58DC8C.exe
- SHA256 787798eea28e8ea672f3cbfe9ec2ca4460098b491031eab0f8c30b7080f5eb00
- MD5 7bec4faccd4b6485d70a5bb46453ed65
- SHA1 e001ad39f7269e5fca76154477e7708b8d729a4b
- SHA512 3deaabc3519eeb1eba3953c2054451f2fa6cfe3f297c643cb29b9017a43d5a43d8dafea5107b0dfe412917932ce40857c0f942e791f76ab8afa5bf4c310b8e37
- SSDEEP 3072:sr85CDzbFk58x+o+EFz9/t2f65q8hPBJ2bIoKbwLIQ8YzXEMZK1A2W:k9vxk5zOFNtgJmBJCUbwstYrEMw63
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ