Static task
static1
Behavioral task
behavioral1
Sample
991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844.exe
Resource
win10v2004-20240412-en
General
-
Target
991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844
-
Size
219KB
-
MD5
86ef9c435fcd0d35721f7ca802248ea8
-
SHA1
eac9ada07ce4f08cc588c9adcc65f742d10637f9
-
SHA256
991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844
-
SHA512
f8d99f80aa1de9f5313499978978c3f0a80c510f497017b9b365681f4becb6b272aa36a043f2368f9f7e05949ba4a39bc4d16adb3f800f1d94bb8e19f7d5a071
-
SSDEEP
3072:tR4jdNqTqHLklZpb4RrRDFBI/cMrnTS4y3NkEjbvjuC8xVkxRQjZ3phRrbh1:7afcEHI/prnm4y3NjTjuC8xOcxph
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844
Files
-
991eec48992cdb5925ff08d1324803cc0d697ac56c1c555f497913eb298d6844.exe windows:4 windows x86 arch:x86
3e3d633779e35448851e7a9ca7e72522
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
Sections
.MPRESS1 Size: 163KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE