Static task
static1
Behavioral task
behavioral1
Sample
5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d.exe
Resource
win10v2004-20240226-en
General
-
Target
5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d
-
Size
5.7MB
-
MD5
e2df2f293641ebb0517370a53dd94836
-
SHA1
3724a4124ed509cd8deb5b597a99a0fcd72d346d
-
SHA256
5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d
-
SHA512
5cc58fb7e32d231245439e7f214c17eb403d47fee5aeff3bb6b204d839eb54bf478d6cdd36ca6fb3c238479580b0bc73c89852ad46b77080eed14b5567c9bbd0
-
SSDEEP
98304:+FDGUxZyPnHrOxYZ3JgOsQ++8ORgVygOGeEhF6EKCjwrZSarkL7:phPnHrOYmQHROTOGewLKawrZs
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d
Files
-
5cffa672ebd1273bff405d41e9ffa4ac3617a15090e9ef9d71acc8169a8bf60d.exe windows:5 windows x86 arch:x86
a0010f9a44f8bab2b514911355945c90
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
atl
ord47
gdi32
DeleteDC
gdiplus
GdipDrawRectangle
msimg32
TransparentBlt
msvcrt
strncmp
ole32
CreateStreamOnHGlobal
oleaut32
SysAllocString
shell32
DragAcceptFiles
shlwapi
PathFileExistsA
user32
AppendMenuA
CharUpperBuffW
wininet
HttpQueryInfoA
Sections
.MPRESS1 Size: - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dyD Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.k@* Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.E*W Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ