Behavioral task
behavioral1
Sample
25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
Resource
win7-20240903-en
General
-
Target
25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
-
Size
71KB
-
MD5
e3e2b715ff511fbbd1319f4d9be1b785
-
SHA1
f1ca8fd66c392b948dea7821426f49b573d221ac
-
SHA256
25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f
-
SHA512
2e3ea75048665116096378c6c3b629e1a26d068f60ae6d60e86ad81b33ec5aa5c5e2958249d049e320e59c3b2b32f7949b3f83fe874d5f30fd079e2b16dda754
-
SSDEEP
1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbHP:idseIOMEZEyFjEOFqTiQmQDHIbHP
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe
Files
-
25c92a82923530fa591ecc1d616f734d2d9cdf316e0eba9f5077b3751edad16f.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE