Static task
static1
Behavioral task
behavioral1
Sample
b565061160d7d6813ac605be99522ac0b11ccee896581698c11f41f93907007c.exe
Resource
win7-20240221-en
General
-
Target
b565061160d7d6813ac605be99522ac0b11ccee896581698c11f41f93907007c
-
Size
296KB
-
MD5
7c6f0318a1d782392484149c89f5e34b
-
SHA1
cdbfac54529fd4aff17462ec292c76ecaf7d16de
-
SHA256
b565061160d7d6813ac605be99522ac0b11ccee896581698c11f41f93907007c
-
SHA512
8958df2a8d83b52cba234fbcf91b27a6bc4fc6f90482737a03c58f9e4ca00701bd510449ee163e9e5bc63e901ed71872ff3371256839994b7be115264acf9742
-
SSDEEP
6144:NxZtkaDv51Tn2qM6De4W40f4oAYrMfZ2kKE9B:JDvTnx7DeN40fnnu/B
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b565061160d7d6813ac605be99522ac0b11ccee896581698c11f41f93907007c
Files
-
b565061160d7d6813ac605be99522ac0b11ccee896581698c11f41f93907007c.exe windows:5 windows x86 arch:x86
2147b95b9c9b001e01ace5f0e2f8befe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
advapi32
RegCloseKey
shell32
ShellExecuteW
ws2_32
recv
iphlpapi
GetAdaptersInfo
Sections
.MPRESS1 Size: 239KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE