Behavioral task
behavioral1
Sample
eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7N.exe
Resource
win10v2004-20241007-en
General
-
Target
eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7N.exe
-
Size
665KB
-
MD5
f593f40740b30e34627808b19938ee90
-
SHA1
aa2e5906bc5db346735d6e126f5e037f78f4560a
-
SHA256
eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7
-
SHA512
a4546dff261dfb3dc1d924fed651a5eb43822f0bf066d85962c0006a40901d1e8d77ce56c4df3ab90109187db533da2bcf081ab72960ef59f7f94d5ab298e4aa
-
SSDEEP
6144:k97UqPg/wobETHTxGmxUceE4wenHDBXR6fAAGIeoclMra0nFe8iSQz7/N2U6Cctt:GUp/wKaHTx3UciwOse7uhn4TFN2U6Bv
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7N.exe
Files
-
eef73af859c16b902fac263fd2f88d3f51e88845f81c75d732f5b94d3749d4e7N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ