Static task
static1
Behavioral task
behavioral1
Sample
b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276.exe
Resource
win10v2004-20240508-en
General
-
Target
b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276
-
Size
693KB
-
MD5
efcc199455507300e70df2fd29ac0162
-
SHA1
e7c5242a38f9c38606df0163d2fde7894a7f9391
-
SHA256
b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276
-
SHA512
3aadca2a489572850bac479147902de6b06a52655f84be11dc4dfbb6d89a0bf8af68c4e7a43b5bf0006a434c48eca87465679e41478a66baaed7d745b6c5150f
-
SSDEEP
12288:wwEmu61x9TjcFynLW4Bzyd8gEDFiHYBWJYfM2Hk/fWdb2IrCmby69kQgJ:TlvjcoC4PDcHYByYE2HeobxrCmby6s
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276
Files
-
b067e7156ca63788056ca2d67eaf12f3ac526ef41bc78d80e648df98f8d7d276.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 640KB - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE