Static task
static1
Behavioral task
behavioral1
Sample
1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9.exe
Resource
win10v2004-20240412-en
General
-
Target
1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9
-
Size
477KB
-
MD5
5b69d9e5204fa334d53a1c08918d6430
-
SHA1
41f5cb6fd983105a802129aa7916b6c49e03fc05
-
SHA256
1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9
-
SHA512
1bf1d965d060af6d607ed223c9b7cb36025b8626cde261ca6ea50ba7212acce0e5f2983e539a457c2ad0588470333995fb6ee7128a14968d52c6d16ed14a055c
-
SSDEEP
6144:3ZSE8UGJwiYwUfWeR7oHYnOW111mFW+ijq:93GFY/jWHYt1yW+E
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9
Files
-
1660e243bac1d8e8bfacd63b01e90eaf5360510cf6aa3bc09f26d3ffaf8733f9.exe windows:4 windows x86 arch:x86
4517235d6f012421e28370dfa4e6f8c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
rpcrt4
RpcMgmtEpUnregister
Sections
.MPRESS1 Size: 165KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE