Static task
static1
Behavioral task
behavioral1
Sample
27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b.exe
Resource
win10v2004-20240426-en
General
-
Target
27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b
-
Size
1.5MB
-
MD5
b0e5c6831cb15eefebe7673b753a0b69
-
SHA1
b8019022ea6181982248f80bb5c6448b4b90d671
-
SHA256
27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b
-
SHA512
6aa8d017b17b17587fccaaeb06b41b4275e41586abff9a0069d3f505c7e66a486efdf4d64a5ffee195a134df0d27a6416bcd09c4fe119b27666cf4e7054a88e4
-
SSDEEP
3072:VR4jdNqTqHL+3phRrbhL0wz5OdRSfBhCgapICVBSwdpDTR8BmA8h1aYDvC8/cI8Y:jafYphowNaSfBF58TQ8GYrmje
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b
Files
-
27ca08d981faa9ba4a13b72e8cf40b44a4216c5c127a57dccb2426ce162c767b.exe windows:4 windows x86 arch:x86
3e3d633779e35448851e7a9ca7e72522
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
Sections
.MPRESS1 Size: 163KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE