Static task
static1
Behavioral task
behavioral1
Sample
1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d.exe
Resource
win10v2004-20240508-en
General
-
Target
1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d
-
Size
46KB
-
MD5
8b653c69bd708f8b381a2e9e437759da
-
SHA1
640adbbf18848a08cbb898c81956e962af304f9e
-
SHA256
1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d
-
SHA512
88c9ab488cdce7942ec2491164d47d10bc3eb9de5f5b497bb5f0cc7863f73b13e1fd6505f854b76b69ad71b362cbfafeabd8330e08e23a49d22934ebe9093041
-
SSDEEP
768:og/HvHfHSEu4qzrEazeKkBVRibsT5bBIYqQl8WkJk1hGjF7DMe2:wE3qz4ayX9ioT5Xl8lQVB
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d
Files
-
1578b9365a7caea9e93f8948b93edb2784a1401b09db4808cec01e3ead86823d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 42KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE