Static task
static1
Behavioral task
behavioral1
Sample
5e08a4be7007daf1dce091bb2917648e2d01d489ef8d40c3a6bd5ab40161d7d3.exe
Resource
win7-20231129-en
General
-
Target
5e08a4be7007daf1dce091bb2917648e2d01d489ef8d40c3a6bd5ab40161d7d3
-
Size
296KB
-
MD5
bb136b8c443f4be958e53c0c14f600c3
-
SHA1
8f6315ed94f19b7a763047cd4852603daf2200ba
-
SHA256
5e08a4be7007daf1dce091bb2917648e2d01d489ef8d40c3a6bd5ab40161d7d3
-
SHA512
ba4cd617f111cf60651513b34de7337cfa255ab8156bb5c7c77c6d0eb4c3b2b91c3717ba75953ed439eb79f5da7429b937712074feea8d2f7fb460883e5b0c95
-
SSDEEP
6144:NxZtkaDv51Tn2qM6De4W40f4oAYrMfZ2kKE9/:JDvTnx7DeN40fnnu//
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e08a4be7007daf1dce091bb2917648e2d01d489ef8d40c3a6bd5ab40161d7d3
Files
-
5e08a4be7007daf1dce091bb2917648e2d01d489ef8d40c3a6bd5ab40161d7d3.exe windows:5 windows x86 arch:x86
2147b95b9c9b001e01ace5f0e2f8befe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
advapi32
RegCloseKey
shell32
ShellExecuteW
ws2_32
recv
iphlpapi
GetAdaptersInfo
Sections
.MPRESS1 Size: 239KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE