Static task
static1
Behavioral task
behavioral1
Sample
2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9.exe
Resource
win10v2004-20240226-en
General
-
Target
2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9
-
Size
221KB
-
MD5
7ed2a3e732bde862b471dceb217d00a5
-
SHA1
2695008e76290d23f279690e1591678976b55d0e
-
SHA256
2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9
-
SHA512
d581ebe04a8b8f86a49bd61ffabb20df77787ef5566b9ecdf70fba746ae6bc9338ae369068006745d04f2a3a604a08270e31c1e2539e7b6321a7bba45d955b52
-
SSDEEP
3072:dR4jdNqTqHLklZpb4RrRDFBI/cMrnTS4y3NkEjbvjuC8xVkxRQjZ3phRrbhFw+O:LafcEHI/prnm4y3NjTjuC8xOcxphtw
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9
Files
-
2532366c747d46ce77d9b0ba78d5240f227a235f873c4fec89eb7cc35c8101e9.exe windows:4 windows x86 arch:x86
3e3d633779e35448851e7a9ca7e72522
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
Sections
.MPRESS1 Size: 163KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE