Static task
static1
Behavioral task
behavioral1
Sample
52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645.exe
Resource
win10v2004-20240226-en
General
-
Target
52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645
-
Size
293KB
-
MD5
48f2ead253c81c033a3ec142b5e018c8
-
SHA1
fc902d4eb676bba1e9e80eda018bcc4f217f99e5
-
SHA256
52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645
-
SHA512
9e01fab7e4fd49ed2d0e4323713495d63581598bec270d557ade401cfd95315c6ef214ac3d2b95e8c44d0823378e56c51fecda7a3f2c107224593b14695d5929
-
SSDEEP
6144:jJuXtXxog5E+FWPNfrf6yGEssQxNpbMAKJcfh2m71Z:N8XNE+FuNfrSyGEssQJVp71Z
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645
Files
-
52be28060c05dc57412e941f3f6d9930fab9e68e454ec408c17e79a9658af645.exe windows:4 windows x86 arch:x86
3e3d633779e35448851e7a9ca7e72522
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
Sections
.MPRESS1 Size: 170KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE