Static task
static1
Behavioral task
behavioral1
Sample
b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3.exe
Resource
win10v2004-20240508-en
General
-
Target
b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3
-
Size
46KB
-
MD5
ab598fa81ec66283f206dbefc5bd23bd
-
SHA1
5660d09a9ca5deec8d278a85d79c90a4f27093b7
-
SHA256
b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3
-
SHA512
ce9d91a295034ad874d4f17f0fa9e42dafb3b2de448e2d8d23b9e47fb3108aa4856252664c482c4e78f97ab0c7a944e8f06228f4796fca43f6b618218b550b9d
-
SSDEEP
768:og/HvHfHSEu4qzrEazeKkBVRibsT5bBIYqQl8WkJk1hGj+7Dp2:wE3qz4ayX9ioT5Xl8lQZ2
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3
Files
-
b6aa650f3b8e17417c8a3c0e94b25e50d144495d8dbad069932d6a3db8a5ecd3.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 42KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE