Static task
static1
Behavioral task
behavioral1
Sample
89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a.exe
Resource
win10v2004-20240426-en
General
-
Target
89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a.exe
-
Size
46KB
-
MD5
0bd3c85c7075548ceba5ea9c9680abfb
-
SHA1
d86ca70c21528131d53c679f98e49f4e67cb872f
-
SHA256
89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a
-
SHA512
80a28f1dc003466050dc7a8bc11314f4ebe78ca6decac9eee584dc70c3d2134fd8f107a8ba05a71da4a9a883c38364604713015033da686452c6e16b300b3715
-
SSDEEP
768:og/HvHfHSEu4qzrEazeKkBVRibsT5bBIYqQl8WkJk1hGjz7Dp2:wE3qz4ayX9ioT5Xl8lQ+2
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a.exe
Files
-
89c8034384cb8a387d428165528e72dfa26db25016c6c70ae5ca9812fc5c104a.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 42KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE