Static task
static1
Behavioral task
behavioral1
Sample
9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe
Resource
win10v2004-20240508-en
General
-
Target
9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0
-
Size
1.5MB
-
MD5
26cf725f4096976fb2729cc656f4ecf8
-
SHA1
b39ecdfcd98ee18b02f3950981cc079d4b573461
-
SHA256
9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0
-
SHA512
acc171f4049e0c19e3dbaa297c142b3e4a55fc8657bf42e5c2b0d146de04ea1a95c381b731b3c91774f2acef1cddb68fa4889592cec8a50796772a1d94058ef5
-
SSDEEP
6144:XElKgzelZNQSBQGH/CSpWqT7wNaSfBF58TQ8GYrmj:5fBQGH6SffwNaSf6cX
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0
Files
-
9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 403KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE