Static task
static1
Behavioral task
behavioral1
Sample
abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a.exe
Resource
win10v2004-20240508-en
General
-
Target
abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a
-
Size
84KB
-
MD5
1d1362f43915a45ffd2281a708b0a943
-
SHA1
c373484b76f714d93f254a1e2a6222bc411198aa
-
SHA256
abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a
-
SHA512
e0ee257aee1d8c82113f90310c1f413671b3cb99bbf9bad1e677259fa8a34f626a96ad1f7f752e26bbc72ed283a6be943d9a9a7b88fd9016731f6e94127a4b48
-
SSDEEP
768:QYHfYErkXzFlB8hRWXZUdqXnzdPLqXbC5t+1l7dExNv8:9rkXjmXABTqXWt+1RdEo
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a
Files
-
abb9be30d320d47763f5bda00899764c6c805ebbfcc7bc4fe919b10d628f069a.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE