Static task
static1
Behavioral task
behavioral1
Sample
86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823.exe
Resource
win10v2004-20240226-en
General
-
Target
86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823
-
Size
91KB
-
MD5
a2aad219ec89d04f3526461ba9140270
-
SHA1
b4b1540741958a58d087d70a67995ce177872eb8
-
SHA256
86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823
-
SHA512
43575dd2dcedb6680db3899e059585759fc1f23bca1e64aa7c8073318bf3d320c3af8caf9a7304bbbbc0b5f7ffa58676e1a889df28d575894710648f0b339d04
-
SSDEEP
1536:zAwEmBZ04faWmtN4nic+6GJAwEmBZ04faWmtN4nic+6GL:zGms4Eton0JGms4Eton0L
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823
Files
-
86bf01fcb6bc5b707cc2f774e1c8a7ef275104f94924320732e441a71e9b1823.exe windows:4 windows x86 arch:x86
b876114877b29a61f9955d83081f159a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvbvm60
ord516
Sections
.MPRESS1 Size: 28KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE