43_mp-hacks-esp-v5.zip
- SHA256 5b1b73f06d34d58cd7a17690ec47ec1a3a431f9555262916393af11a794bc3bf
Behavioral task
behavioral1
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
ReadMe.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ReadMe.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 43_mp-hacks-esp-v5.zip
- Size 73KB
- Sample260721-pmbffabn21
- SHA256 5b1b73f06d34d58cd7a17690ec47ec1a3a431f9555262916393af11a794bc3bf
- MD5 9f7d0c14eac41868b4e45ae977156493
- SHA1 9ae9d0427e9f7ef67332f18cc17f71e37d2f91c3
- SHA512 cc8b7f47c7d6a48af515b160af0d06d12f54b7238d158e81cf4c98b971f47e49b5097a70b1f1604bfca759f9f578fe181087390460c5d87d47f2061d64db0858
- SSDEEP 1536:3jJ0H44vAMXDJlL8Lpa7wuDH7SqAPTzT+C2yYvL5Do1azTxJeWvF:V+zVtl4Lc7wcSqWTP1W8Mze4
- TLSH T1267302CF6E061100DB90D17E6E2ACA8F89AE2D4BE017AE58DCF88FF9149569C12F4D14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/MP-Hacks ESP v5.0/MP-Hacks ESP.dll acprotect -
resource yara_rule static1/unpack001/MP-Hacks ESP v5.0/MP-Hacks ESP.dll upx static1/unpack001/MP-Hacks ESP v5.0/MP-Hacks ESP.exe upx - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/MP-Hacks ESP v5.0/MP-Hacks ESP.dll unpack002/out.upx unpack001/MP-Hacks ESP v5.0/MP-Hacks ESP.exe unpack003/out.upx unpack001/ReadMe.exe
File Explorer
-
43_mp-hacks-esp-v5.zip.zip 73KB
-
MP-Hacks ESP v5.0/MP-Hacks ESP.dll.dll 51KB
-
out.upx.dll 104KB
-
MP-Hacks ESP v5.0/MP-Hacks ESP.exe.exe 22KB
-
out.upx.exe 44KB
-
MP-Hacks ESP v5.0/readme.txt1KB
-
ReadMe.exe.exe 4KB
MP-Hacks ESP v5.0/MP-Hacks ESP.dll
- SHA256 48e89a1b2b5a65d95190632080a1761e5a89cf8f40fbbc668342c3fca24f2fab
- MD5 92ca0492a0ed5d22e1c2b466e7c7efa6
- SHA1 dd022701851e67cb14edbaec613a5095d8fa6739
- SHA512 6135552937af355f8f873897fa8859129b269c400058ef807371185ec57dcb44e0055d2bdb71229aab0e044b02157aa7522c50d683f426964297eddb1be3e435
- SSDEEP 1536:kN8JytYCi6qh8UoUrLSUW2TkhD0JFEPDUkEO:JytioUd1SDeXk
- TLSH T1DA33F10BE96A21E8F5AFF07DA064F611B35EF52842EF856405767D0F1B9BE24031A1CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
131648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
UPX0
Size
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
49KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=105, version=2067,
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=127, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=100, id=1, productName=Unmarked objects,
count=27, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
out.upx
- SHA256 9271257204297937432beb3d537d5ec033705ae20d6c956708e964c7f4a30226
- MD5 b74bf18892b5a65d036fdf1e32f57358
- SHA1 286fabde8fc7292d7154bafce148f18c33d47f5e
- SHA512 24f2ce735ba40a5158cdbfb067582217595eada0ab066f63ca287f9b677f650c46d1683d83bba05f5fe7793192aa6cf4eefcd286c97dca76d2e80fe8eb840aab
- SSDEEP 1536:r+U9P8t0RDGoArbN9WW8OOqDMPoX/VfXagUswlq8n7VaF7VG:r7PRyBPWW8GuxcVG
- TLSH T1EAA38D1376E1D0F1D099487D88976626AB7BBE704EF54E833F78361D9E352A28A37700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35843
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=127, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=100, id=1, productName=Unmarked objects,
count=27, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
MP-Hacks ESP v5.0/MP-Hacks ESP.exe
- SHA256 0434fe06678f0b8d2a54786f1274c56d8a4212f3169676eba5421e3957d36ee7
- MD5 2226a3cdca1c6d4895a3e5d2bb1c7f3b
- SHA1 da81b280c81dd3aa628200912ad2d837b2a0875c
- SHA512 7dc7655d741d24d4ecf57457b30df8f67c8f55ce3fabe5a86e3ba672725a81bfac2e52c5cd3a28418afde02a171d8d986bc38ce5d78096058070505e3421b8a7
- SSDEEP 384:/04ntqTypPQ+y9gXwLAJiP/Ug5F4NSXGDb513P4Bs6iOHJq8uOL:xtyyW+y92wHP/Ug8S2BhOP
- TLSH T1BDA2D0366BC1C39ADF687973C124621870897E02DDF96DD715DA328BBDCC2E0179C929
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
20KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=83, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=14, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=3, id=93, version=2179,
count=73, id=1, productName=Unmarked objects,
count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
out.upx
- SHA256 08cea0f5952910dac509157716e5d0fe3c183925bb37f8e99a47774f85ab4527
- MD5 4a09c16dce27380261769ffa5fcc8183
- SHA1 f78caf99e9302753ff34cfc5933a015d7d345d9d
- SHA512 37b06213a6588062da12ad26bfdc052858ba705a1ba441f865f01b830fa047a3943dec54e6ab54ba62c31343823c0c4c16ce42ee66ecd07a1796f8b86f20f040
- SSDEEP 768:M3M+r1JyXzoQ4/TMEoC0on74MnRfYgDSqMp:M3M+10zP4gEH0iFR7JA
- TLSH T1AD136C33BDD2D1B6C89595F0017C4706AB3FB91113F886678B68195EBE222E19F3E306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5865
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=83, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=14, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=3, id=93, version=2179,
count=73, id=1, productName=Unmarked objects,
count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
MP-Hacks ESP v5.0/readme.txt
- SHA256 97d1fb2dd58c13a5ce3ce83f0d74540c1cfe43e6a1e4badc59ac527b74baf186
- MD5 0c50506653f72fdd6bca6e742b9c03f1
- SHA1 e93e045cc446b9a712053cbc3efa26255f28390e
- SHA512 fb3accf95b9688ec39c6bf131f89e21fa922407841e5cf7b9ee6f0f995dc30b016ced98cfb5526274fdf354500198a9fa4c0a8709981dde263b87a6aa9df6bdb
- TLSH T11511324CD921D8C4327B815BA3DA6B80DDF2F633D1F44A01FCAB86592F9824EC604F85
- MD5 SHA1 SHA512 TLSH
ReadMe.exe
- IMPHASH 08b30c8f4eb7b0e22b13e9a4bf0c2b52
- SHA256 b8055fc0bd75b06c0ad9fd1406ce4cf8250c8b274e33baaf3bbc47c2789abf11
- MD5 01044de62177d857a208f18a84a22c83
- SHA1 cafbf6ea00d99f7464a5cf6074f5dfaa99d4aa40
- SHA512 9d0bfa4c36362a71b565bc17f07960c803234dcd4596ed589652bcbc46cc45d679a8315b048c3afde2591b43d6cb786382beb6add6d75acfe7fa3c0f0dcc4682
- TLSH T19E81EC03BBA1CA61C4518B7111931FC979BBBD311762430A0F5B3CE9B930368FF29A91
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
GetDlgItemTextA
DialogBoxParamA
GetDlgItem
EndDialog
MessageBoxA
SetFocus
kernel32
ExitProcess
GetModuleHandleA
Name
.text
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, productName=Unmarked objects (old),
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,