Behavioral task
behavioral1
Sample
9cfdaab58edcca5b8ccd8f35bd2f13198ef19cc2c6572da18cc793734710c942N.exe
Resource
win7-20240903-en
General
-
Target
9cfdaab58edcca5b8ccd8f35bd2f13198ef19cc2c6572da18cc793734710c942N.exe
-
Size
71KB
-
MD5
64b0bf70fefe4bf1296961ce787bfbf0
-
SHA1
289a69ff9545ce549ed89088fc1ff0fa24444a12
-
SHA256
9cfdaab58edcca5b8ccd8f35bd2f13198ef19cc2c6572da18cc793734710c942
-
SHA512
be8a610a89b5bf1c3f462378fcddcf85a8ea8f079fc67cf88afc054ecfe7f77301f563218ed64f12a20fc110b9fc3acdae2ed3c61f310342d7766328ce6d6b6b
-
SSDEEP
1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:TdseIOMEZEyFjEOFqTiQmQDHIbH
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9cfdaab58edcca5b8ccd8f35bd2f13198ef19cc2c6572da18cc793734710c942N.exe
Files
-
9cfdaab58edcca5b8ccd8f35bd2f13198ef19cc2c6572da18cc793734710c942N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE