Static task
static1
Behavioral task
behavioral1
Sample
95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298.exe
Resource
win10v2004-20240508-en
General
-
Target
95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298
-
Size
5.7MB
-
MD5
bf6c3c6d901d3cf9fdd29f931c17ffca
-
SHA1
7e06d6adb811b626c9c8b77be530ec9a7076a355
-
SHA256
95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298
-
SHA512
a998746704e202891111cbf4aa9a24f8433b21f56bd905078580bf714c19b86223820415e76ee99f28bc3d416ef5d19725de9139fd90f997554c59ff7ea854cb
-
SSDEEP
98304:1JStxBeOYrT8jV+slVNp8NtBb/IiXVbdfuphU4jfWoMA0V11//V0:DS3YrT8f8NPbwilbdWphPK007T0
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298
Files
-
95f17817d05b4a7fd7ac0089204a77fa80688f4e8f2751b358b3438041155298.exe windows:5 windows x86 arch:x86
a0010f9a44f8bab2b514911355945c90
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
atl
ord47
gdi32
DeleteDC
gdiplus
GdipDrawRectangle
msimg32
TransparentBlt
msvcrt
strncmp
ole32
CreateStreamOnHGlobal
oleaut32
SysAllocString
shell32
DragAcceptFiles
shlwapi
PathFileExistsA
user32
AppendMenuA
CharUpperBuffW
wininet
HttpQueryInfoA
Sections
.MPRESS1 Size: - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.htext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.u7v Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CW- Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.(c= Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ