Static task
static1
Behavioral task
behavioral1
Sample
87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef.exe
Resource
win10v2004-20240508-en
General
-
Target
87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef
-
Size
20KB
-
MD5
2df24b2b1c69feed8d520a1dfe051b2c
-
SHA1
9906ac1c53f8b6708ab493416036e141888b3374
-
SHA256
87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef
-
SHA512
763602c82b9449f7184187bf0f9a8440d7e4c4c0acb7aa7493306b897dc6d998e1fc0433a2077a137a8a89ee6673077b735968b23a24f5a69574a1cd0e940734
-
SSDEEP
384:QJw6ACEjSU0xpC5B+SEW7vvxlLg94calJJjjjCDAAAAA:Qm6AC0qCaSF7D7Jjj
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef
Files
-
87071bc6fbdd1e21a366a0648d8a1b1ea3bbdd8e5dea65611298e7c5aeea10ef.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE