General

  • Target

    MDE_File_Sample_3f3b5b0533b1d28060702a78c3f55a1ffc7ca88a.zip

  • Size

    6.0MB

  • MD5

    e6fb0c2c13a09c39dfc9254833419002

  • SHA1

    aef842baf9ee727f4868744dd3e1799afba6915d

  • SHA256

    9eb4930de7749c37991527094f00c11809f581544c4e43acbaf250e889f59f5c

  • SHA512

    c975d74ef5db8601819bcee987fd4df40bea5c14314eb496cf4b13246674ca481df65940f757687513e2e8ab07b9fe078c192066a9fb679dc0ab5da1b40d3e00

  • SSDEEP

    98304:XPmm8mC2UVyw54YUleTP5z3zwyEgQqAW37FSa5+2LxvI8GXpwwVofqtGsrTQ5Fq:XPjC2fw54Y5RfnRSU+2Leanfh0s5Fq

Score
8/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

Files

  • MDE_File_Sample_3f3b5b0533b1d28060702a78c3f55a1ffc7ca88a.zip
    .zip

    Password: infected

  • Market Reversal Alerts Indicator 5.10.zip
    .zip

    Password: infected

  • Expert/Market Reversal Alerts Indicator 5.10.ex4
  • Msimg32(v3) Build 1350/DLL Install Instructions.txt
  • Msimg32(v3) Build 1350/Download Build Here.txt
  • Msimg32(v3) Build 1350/msimg32.zip
    .zip

    Password: infected

  • msimg32.dll
    .dll windows x86

    Password: infected

    e5826bdd574644f867c97b25acd0860c


    Headers

    Imports

    Exports

    Sections

  • RULES!!! Read first (eng).pdf
    .pdf

    Password: infected

  • Read ME.pdf
    .pdf

    Password: infected

  • Readme.txt