Behavioral task
behavioral1
Sample
ed65551c6e02771116ae3e8961488194a58b82063f38f992d0388bef972819ed.exe
Resource
win7-20240903-en
General
-
Target
ed65551c6e02771116ae3e8961488194a58b82063f38f992d0388bef972819ed
-
Size
71KB
-
MD5
962086da916bed4b6c8c4a31b7b2dfd3
-
SHA1
53fbbeb2ac17f172397f6d7129f17aa2be6cde93
-
SHA256
ed65551c6e02771116ae3e8961488194a58b82063f38f992d0388bef972819ed
-
SHA512
425e33623bf1636caf95096a06426bc0e200e0aab92fe1a564e2e4685f010d1041f4b0fe37ad1dad36fa6aee5f78d22cfaabb7b1c97481b47f8b9234b15e390e
-
SSDEEP
1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:7dseIOMEZEyFjEOFqTiQmQDHIbH
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed65551c6e02771116ae3e8961488194a58b82063f38f992d0388bef972819ed
Files
-
ed65551c6e02771116ae3e8961488194a58b82063f38f992d0388bef972819ed.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE