Static task
static1
Behavioral task
behavioral1
Sample
78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb.exe
Resource
win10v2004-20240419-en
General
-
Target
78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb
-
Size
530KB
-
MD5
02dec9cd5c09dbe5341cd1cbae515f7c
-
SHA1
e420e992268e20b4f718309c6755235f460a1096
-
SHA256
78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb
-
SHA512
cb0c141ff7e3f7494cc893ecb03c77c0fcfbd0f87f72b5d0084533cd2a1c3b567073ab15ed01e5bc0d7b059b43796829ca4d64cfa06caf7e15dde4b8681fad4e
-
SSDEEP
3072:3CaoAs101Pol0xPTM7mRCAdJSSxPUkl3V4Vh1q+MQTCk/dN92sdNhavtrVdewnAM:3qDAwl0xPTMiR9JSSxPUKuqododHYU
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb
Files
-
78fffc371a88c22f9cacf3880b69f4ad6560d033754f5ed257527dd02e53fdbb.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 513KB - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE