metaquotes | c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b

General

Target
c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b
Size 1.7MB
Sample260901-vtfavsdg53
SHA256 c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b
MD5 9cbba09a2dffc5f9d87377bb364b127d
SHA1 94a1d23f585a4b84364041c5fbf9d5a2896fbb39
SHA512 90510754d0221c031191344d89388e9635cf0469bfbdbadf88b20ad692fa7078fc1d348533418254b5f7656d52d098ded4b54178df15813d5cc8d214b6e018a2
SSDEEP 12288:NWl7hT4DXJFWKZaaLq2njmtv8TN5TkDM1nNu5j1ZEfkqF544Hw1XwxFZ:0l7iFWKZaObCtv8TN5TK4t4NQFZ
TLSH
T10D85720BA6F9C114F5B2A770DAB582F5197B7E40DB38C5CF524A3C5C3478AB0AA20767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware metaquotes

Malware Config

Signatures

Family: MetaQuotes
MetaQuotes is a Windows adware family.
adware metaquotes

Detects MetaQuotes adware 1 IoCs

resource	yara_rule
sample	family_metaquotes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b

File Explorer

c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b

.exe 1.7MB

c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b

SHA256 c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b
MD5 9cbba09a2dffc5f9d87377bb364b127d
SHA1 94a1d23f585a4b84364041c5fbf9d5a2896fbb39
SHA512 90510754d0221c031191344d89388e9635cf0469bfbdbadf88b20ad692fa7078fc1d348533418254b5f7656d52d098ded4b54178df15813d5cc8d214b6e018a2
SSDEEP 12288:NWl7hT4DXJFWKZaaLq2njmtv8TN5TkDM1nNu5j1ZEfkqF544Hw1XwxFZ:0l7iFWKZaObCtv8TN5TK4t4NQFZ
TLSH
T10D85720BA6F9C114F5B2A770DAB582F5197B7E40DB38C5CF524A3C5C3478AB0AA20767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects MetaQuotes adware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

101815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c3d579a215527984c05d236e438660bf93eabc4a8242403b9a2e6e3fe9a5828b

generic