74f84ce081da466694ccad2e569f706d4cb23d9c441ccdce812bf5afbb67607a | Triage

Sharing

General

Target

74f84ce081da466694ccad2e569f706d4cb23d9c441ccdce812bf5afbb67607a
Size

43KB
MD5

36579ca406ecb8250fd053a059bdd6d4
SHA1

edafa4b1bbcd8f14fe83aa6012634aa4105586ff
SHA256

74f84ce081da466694ccad2e569f706d4cb23d9c441ccdce812bf5afbb67607a
SHA512

a66f9ab9419e33b285d1303cb250aa202b08c294c68ee48ed25ecd03af4ddb299339ec8bac986f1cdab166f470388438d41b7ae50a60491067e271a31873dbb2
SSDEEP

768:lG/IU3xbj25f+rBQIhhuLn7D/yDLT5YXRtqcspaDvoQC:Sxbj25f+rPSyXT5YXRtqcspaDw

Score

10^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74f84ce081da466694ccad2e569f706d4cb23d9c441ccdce812bf5afbb67607a

Files

74f84ce081da466694ccad2e569f706d4cb23d9c441ccdce812bf5afbb67607a
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 21KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE