Static task
static1
Behavioral task
behavioral1
Sample
f2cba2e05d3d937fa7ee44a0da60ac8b32a21ca073b3b39c6b184bd883eace42.exe
Resource
win7-20240221-en
General
-
Target
f2cba2e05d3d937fa7ee44a0da60ac8b32a21ca073b3b39c6b184bd883eace42
-
Size
295KB
-
MD5
2326b29e965a889666103f22a1d12cf0
-
SHA1
2db43cf854d21e14f51f8865c46f0e4a78834653
-
SHA256
f2cba2e05d3d937fa7ee44a0da60ac8b32a21ca073b3b39c6b184bd883eace42
-
SHA512
f017c64651fc4130dc98f68d7dd9948cfe0b1637129ad22240d7b09a29567401b12a36ffa278e66adbf78bc5b43acedc146f618c32c0a41e12ec68e34fd8531d
-
SSDEEP
6144:NxZtkaDv51Tn2qM6De4W40f4oAYrMfZ2kKE9V:JDvTnx7DeN40fnnu/V
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2cba2e05d3d937fa7ee44a0da60ac8b32a21ca073b3b39c6b184bd883eace42
Files
-
f2cba2e05d3d937fa7ee44a0da60ac8b32a21ca073b3b39c6b184bd883eace42.exe windows:5 windows x86 arch:x86
2147b95b9c9b001e01ace5f0e2f8befe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
advapi32
RegCloseKey
shell32
ShellExecuteW
ws2_32
recv
iphlpapi
GetAdaptersInfo
Sections
.MPRESS1 Size: 239KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE