Static task
static1
Behavioral task
behavioral1
Sample
533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513.exe
Resource
win10v2004-20240412-en
General
-
Target
533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513
-
Size
205KB
-
MD5
9979b81058444e631abb6026f8b1d8d1
-
SHA1
acfa604a4e00ea5d018e7a44ea0d0804f0137ef5
-
SHA256
533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513
-
SHA512
53828d2b0b394f2e741e83cf4dc54cba5a92da697f8cbdd7728242cd1556cacca5b0aa67299a4eba046fa0de15fc541970ddd1f4aede3aebee73c686dc266761
-
SSDEEP
3072:E/5F/E7tEf0i+p+tYlpJH7iXQNgggHlxDZiYLK5WpYIGmF3onW+MBm:EhF4cH+wWJH7igNgjdFKsYmF3onW+x
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513
Files
-
533c88e202386ad7c52c7cfc60498bb6a06df207d26c05f52a89a16b53f9e513.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 140KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE