Static task
static1
Behavioral task
behavioral1
Sample
598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366.exe
Resource
win10v2004-20240426-en
General
-
Target
598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366
-
Size
293KB
-
MD5
5963e2346810effae202f8c70b8220d4
-
SHA1
f71b7bd00e6661872cd3b23da4f118b5b67ab9b5
-
SHA256
598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366
-
SHA512
eef8b19b7c332246b206ab8a96bf6b3ebf62f15801d22ab222730dacc388c776baf8fbe04a802628333ca88b3e527b417a8bb8466f5fbed52a2d3bdd8a84dd86
-
SSDEEP
3072:zgV7qqpBXXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBK91gP:U1rlKgzelZNQSBQGH/CSpWqTTmQ
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366
Files
-
598b2429821243b2513bdddb4182387fd278a9d6341a07ed4e514465a637a366.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE