Static task
static1
Behavioral task
behavioral1
Sample
98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707.exe
Resource
win10v2004-20240226-en
General
-
Target
98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707
-
Size
142KB
-
MD5
8f3ab0161506e5b4aaa98f14cebc44e7
-
SHA1
7c89ace6bd445390400f0dbce34f7bf725740937
-
SHA256
98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707
-
SHA512
71143eb76c1670129ea0294f9aa338280a90a0a683087ff0f2cc591de1f2453ff51dbc2f0f956024ed09cf3d191fb071e03f3ac823748bcdece028cb556c8865
-
SSDEEP
384:tQ7ruB+UthhIdi3ZSz+EJxuVczXKSuSHYGSjyc3bcXVYpT0u1GcfMD01j6QITeQA:ZPt8dH5JZTKSu7ycEfcTu7zVs0ei26c
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707
Files
-
98db23bc2b6ea733fbfd66ee93ccb28e4522f9947d1eca36e4570d5fcb5dd707.exe windows:5 windows x86 arch:x86
f3e3791f85a6950ffa3d1dd4505cc55e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
LoadLibraryW
UnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleW
user32
BeginPaint
DefWindowProcW
DispatchMessageW
EndPaint
GetMessageW
RegisterClassExW
ShowWindow
AdjustWindowRectEx
CreateWindowExW
gdi32
TextOutW
Sections
.MPRESS1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE