metaquotes | 8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0

General

Target
8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0
Size 1.6MB
Sample260825-plfnrssblf
SHA256 8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0
MD5 67804c23b872d5265cf5a0391f20aecb
SHA1 0d35c224bf95b606b95ec5334bc5d092995ef7be
SHA512 d293beb7ca5f4d0d9180cd47bc026e51db8fce4c7a1e37f692154bc70c8aad69362f6cc297c15d7c9a4579e1046abc8e8fb5ed92776e36c44fc13c98647884a2
SSDEEP 12288:0rPfGVIEuq3hvxZyoCNDiESi9bLT1zTDD21nNu5j1ZEfkqFp8MLtc:OP253hvxZy9UEd9bLT1zTfed8qC
TLSH
T1E485610BA6F9C114F5B2A770DAB582F5197A7E40DB38C5CF524B3C5C3478AB0AA20767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware metaquotes

Malware Config

Signatures

Family: MetaQuotes
MetaQuotes is a Windows adware family.
adware metaquotes

Detects MetaQuotes adware 1 IoCs

resource	yara_rule
sample	family_metaquotes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0

File Explorer

8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0

.exe 1.6MB

8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0

SHA256 8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0
MD5 67804c23b872d5265cf5a0391f20aecb
SHA1 0d35c224bf95b606b95ec5334bc5d092995ef7be
SHA512 d293beb7ca5f4d0d9180cd47bc026e51db8fce4c7a1e37f692154bc70c8aad69362f6cc297c15d7c9a4579e1046abc8e8fb5ed92776e36c44fc13c98647884a2
SSDEEP 12288:0rPfGVIEuq3hvxZyoCNDiESi9bLT1zTDD21nNu5j1ZEfkqFp8MLtc:OP253hvxZy9UEd9bLT1zTfed8qC
TLSH
T1E485610BA6F9C114F5B2A770DAB582F5197A7E40DB38C5CF524B3C5C3478AB0AA20767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects MetaQuotes adware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

101294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e7f82a124dd5e4364718a2628025848ca6d2a1ff91e770f56f86204ec13bed0

generic