Static task
static1
Behavioral task
behavioral1
Sample
0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d.exe
Resource
win10v2004-20240419-en
General
-
Target
0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d
-
Size
158KB
-
MD5
a90e18281ce3df17891957a18b82cf0f
-
SHA1
92934b0d8e313091f3463025fea5359413a982fb
-
SHA256
0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d
-
SHA512
2f4b38183afe1658f92c3a7300890e28f89a54f07354e292ad51f30386a586630fa44eb89c4561513531e6a6b9d69d84f1be3e85641c21639ff33949ca83a67f
-
SSDEEP
1536:uvUvE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZp4ZDp/naRRXB:PC79l86WqGzIfjZpSDp/naRRR
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d
Files
-
0a950487e1e5fdc31fdac297adf226b604568a32517d27c5b80acd45a9c0906d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE