Static task
static1
Behavioral task
behavioral1
Sample
8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b.exe
Resource
win10v2004-20240226-en
General
-
Target
8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b
-
Size
52KB
-
MD5
d85ff6d95b57dc3597fe543a9b870d86
-
SHA1
700bf62466aca0a1368172707bb819ef40329d4c
-
SHA256
8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b
-
SHA512
b289123c4d7c0530e4a01b233eba589a1e6269a59ef1d34c93f0f9c5a50fa6121b93228ece3f2f673b424148cf880549051995f0b202382f3b8fc909099c2e4d
-
SSDEEP
768:xLzrPIsVU080KYmz/IfhX5GaeimBYsHotogR8ARwre7zgVqMNWcRFD7DpDM:lvU080dGSh4Fb08ATzgV5Wc4
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b
Files
-
8b0c1cbb8aa682264f27e03c94535689b4d623d3af40886091df3fc913cd395b.exe windows:5 windows x86 arch:x86
77f51df9713d8759f46f198af959d5a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
RegOpenKeyA
Sections
.MPRESS1 Size: 42KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE