Static task
static1
Behavioral task
behavioral1
Sample
c3d6c7c9f909a3b7d54ffa0634d453ec2f48b973d439d9ce502df646da42f8d4.exe
Resource
win7-20240220-en
General
-
Target
c3d6c7c9f909a3b7d54ffa0634d453ec2f48b973d439d9ce502df646da42f8d4
-
Size
94KB
-
MD5
4aa063ba4fb63ff349391c6592e4e14a
-
SHA1
b1640b759c5fbbb35ce1faab74c63866d4c0a54b
-
SHA256
c3d6c7c9f909a3b7d54ffa0634d453ec2f48b973d439d9ce502df646da42f8d4
-
SHA512
2466a38f714d8255c846b0502618d41179c1c0fccbdcfd7ad5a43628811aa768b447c0a7edf4f1898cc1fd90be5457710df05788dadfc67d7f6fc6077e239651
-
SSDEEP
1536:NzPr/365lm9HM3RgIHYBv1osX1XCDN/on9CW:NzTS5lm9aRgCkgR/onEW
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c3d6c7c9f909a3b7d54ffa0634d453ec2f48b973d439d9ce502df646da42f8d4
Files
-
c3d6c7c9f909a3b7d54ffa0634d453ec2f48b973d439d9ce502df646da42f8d4.exe windows:5 windows x86 arch:x86
0387d7197769bd3cd788524003bf2efa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
advapi32
RegCloseKey
shell32
ShellExecuteA
ws2_32
WSAStartup
iphlpapi
GetAdaptersAddresses
Sections
.MPRESS1 Size: 42KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE