Static task
static1
Behavioral task
behavioral1
Sample
10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe.exe
Resource
win10v2004-20240426-en
General
-
Target
10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe
-
Size
593KB
-
MD5
033c106ee07bda3357bc23f3f9b89b73
-
SHA1
bf3c115a0d2410fc7b78c8c203a843ac45daab1d
-
SHA256
10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe
-
SHA512
8e30157b8b6c06b3ec9a8f7d90033e43d0257426ca379714b6427776acfa1b5e821b600330b7f7badcfcf28a944e1ed58bf53078eca005974142fe2b70e61e76
-
SSDEEP
3072:6CaoAs101Pol0xPTM7mRCAdJSSxPUkl3VqMQTCk/dN92sdNhavtrVdewnAx3wmVG:6qDAwl0xPTMiR9JSSxPUKadodH6XhO
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe
Files
-
10469d5354884b1985e8a4ce9f6426aa2c9cad77091aa19183384d4b18b8bfbe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 580KB - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE