Behavioral task
behavioral1
Sample
d66c874df0a51f5873fe388af4ba0426fac6fb569f7341b812a7a78552331ba6N.exe
Resource
win7-20240903-en
General
-
Target
d66c874df0a51f5873fe388af4ba0426fac6fb569f7341b812a7a78552331ba6N.exe
-
Size
71KB
-
MD5
19b264530ebd88a4daa31dfde236dfb0
-
SHA1
77ca31c073d38dddd69c7285e03af799943c5459
-
SHA256
d66c874df0a51f5873fe388af4ba0426fac6fb569f7341b812a7a78552331ba6
-
SHA512
1591692d119663c9d69388405884e98b8957fdb16391b6939565035d1174dcf1d187769acfbabb970578ee2bf83583e9ef1d8ae6d486a1ac6a236deef7d4c469
-
SSDEEP
1536:0d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbHP:MdseIOMEZEyFjEOFqTiQmQDHIbHP
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d66c874df0a51f5873fe388af4ba0426fac6fb569f7341b812a7a78552331ba6N.exe
Files
-
d66c874df0a51f5873fe388af4ba0426fac6fb569f7341b812a7a78552331ba6N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE