Static task
static1
Behavioral task
behavioral1
Sample
e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971.exe
Resource
win10v2004-20240226-en
General
-
Target
e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971
-
Size
40KB
-
MD5
ce826eb565b96606bbc85b8d91f9ed0a
-
SHA1
94ad55b8ca724aa9346d3154d06ea0e731f1d446
-
SHA256
e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971
-
SHA512
897f304ce2b14972d849f52b40a8a37f528e231b03faaf72a6f80809b1fc9144b722bdb2ce35f000b48c25057d183c2d52482d14effa968dcd5b1d0826370ba2
-
SSDEEP
768:kIv7gX8D0+H/l8X6noN7DSlhVtQZsQ/TTiZT36IVu8QF:kSPNKqo0lhVtWsQ/T2ZhVuhF
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971
Files
-
e42dd8b815ec95261e7eb38e9d8beb8667a2dc748055e43f4755b8ccb05b0971.exe windows:4 windows x86 arch:x86
c8f09285f23cecc71913880c632b307f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
gdi32
DeleteObject
comctl32
InitCommonControlsEx
shell32
DragFinish
crtdll
exit
Sections
.MPRESS1 Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE