neratka[.]exe | Triage™

General

Target
neratka.exe
Size 3.4MB
Sample260629-ph47ysc17z
SHA256 92b92e476139e03c08558c569d205ea27d4875969c1caf34a6b53ab3ea891997
MD5 6f640cb1975384c3d9534e7bb3f6c969
SHA1 d924bfbf2f5360d741b7d909d93d80dc3c9af2a2
SHA512 221745b95f50264445d52d6108fae937b5fdd04cd0dd904b5ba58dff184c7a5391b27bf718a61ed32b9b878b26f9b48fb308d76769d339732f265b0e859d4597
SSDEEP 98304:Wo5e+zWsODALb7Q9qCTzc9vkEY17F1yXMXifnO1:WpsFDQQXulj11SI
TLSH
T1FBF533D0F60880CBD2F7D0B685BB782F2E5DE7064D7A0B8376B441464D0D99A7E27A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
neratka.exe

SHA256 92b92e476139e03c08558c569d205ea27d4875969c1caf34a6b53ab3ea891997
MD5 6f640cb1975384c3d9534e7bb3f6c969
SHA1 d924bfbf2f5360d741b7d909d93d80dc3c9af2a2
SHA512 221745b95f50264445d52d6108fae937b5fdd04cd0dd904b5ba58dff184c7a5391b27bf718a61ed32b9b878b26f9b48fb308d76769d339732f265b0e859d4597
SSDEEP 98304:Wo5e+zWsODALb7Q9qCTzc9vkEY17F1yXMXifnO1:WpsFDQQXulj11SI
TLSH
T1FBF533D0F60880CBD2F7D0B685BB782F2E5DE7064D7A0B8376B441464D0D99A7E27A1E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12929600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths