Static task
static1
Behavioral task
behavioral1
Sample
d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe.exe
Resource
win10v2004-20240419-en
General
-
Target
d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe
-
Size
592KB
-
MD5
028ab0600bcf48bc7c81b92e8033d0ce
-
SHA1
6352863c83e3d1ed09e1af3be274ff53277f6b4b
-
SHA256
d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe
-
SHA512
051af68905dd0d983caa9012aee7b20b6fdde767b2e12a67e9305c674f409b7ce47697fd07bf43b946d832e635b08bccae6261e381f9d5d65c6b1a03df9cb735
-
SSDEEP
3072:6CaoAs101Pol0xPTM7mRCAdJSSxPUkl3VqMQTCk/dN92sdNhavtrVdewnAx3wmV2:6qDAwl0xPTMiR9JSSxPUKadodH6Xh+
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe
Files
-
d29981bb8008d4b12d2c484aaa3d7ca084f048a150487e33900a3370f46ea4fe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 580KB - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE