Static task
static1
Behavioral task
behavioral1
Sample
dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204.exe
Resource
win10v2004-20231215-en
General
-
Target
dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204
-
Size
459KB
-
MD5
e4de0ada28c260a5496d6e6c6b595c24
-
SHA1
e709a0922dedcd71a653776d0226a409f398a135
-
SHA256
dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204
-
SHA512
ec403f7cc46a7da1578fbaf2aaaaf9a6a3ae8e5ec12af3d709f0f89b45410bac7554ec9548e453ad01f60567e8ab5bbd54f9664376004882cdb4cf0a80114ea1
-
SSDEEP
6144:MrnkP+6t7nkP+6beheDObSxbSVtbSyheDTheDHheDHheDObSSSqzV1LNQheD6EWQ:MQ++g+RJeKBx2aaJ0QLNehEW7evv
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204
Files
-
dfdf657430e8268a8cdb17ea02f86055ab613bfa2136469e7be336d53fefe204.exe windows:4 windows x86 arch:x86
667d2920f30825a569e99e87ab0b9e43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
atoi
oleaut32
GetErrorInfo
user32
wsprintfA
ws2_32
htons
Sections
.MPRESS1 Size: 17KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE