Sample details: 07908b35d62a253c010bb49b93928a8b --

Hashes
MD5: 07908b35d62a253c010bb49b93928a8b
SHA1: b340714367f4cf69e8af1e9d12150e42e620ea10
SHA256: 6d7d709a9e7222161ff0c53da6d362f243109b91d58b80f77224b94fa42c7182
SSDEEP: 12288:8b1FSg/wFnnoLhPuORUDzq0wZA4HYvlgyyN3WgiS4Q:Q1tYCLhXeDYZVHsZsWA4
Details
File Type: MS-DOS
Added: 2018-12-13 12:46:34
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/contentis_base64 | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://saint-mike.com/kresss23.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2
v2.19R
]eIqC%
0 2w/nB
Q_y"lC.
4{?|Wx
5l!Zldo
e=te(Aqo9=?
dr*\2^
0rTPIW
*5YgYA]
P@W)')
pKK`T/5
3S6Twk&!
XiNIAI
~&Wm3!
/V$.T-O<"
V/%6)W
AYO<,[
L,TX5f
6q":@E
yF#:<Z
bEg6-0
)._vq{A
#23|40
~G{"C[T(gvxg*
dyXcP_
tG\WP4
nr<USHC
V|"{:	
U_76h+
<H >ZI
I7A[*`
=TAS5G
s%UrzM
Z}`8nO^
]aF'Xkm
J}IRt"
.iS*Jr
^"itR3
[^23lR
BMbLJ6es
7R$kK\
Xo7P6DA
=@R/i6@
uu"-[PS
re#s.I
wv}+8vV
s#V<P3
REtVK>
(uVpUP^
/7CF(E
1dV+I{J
::(H{v*4
q)S."#|
`+=k^&6
{$@NDS
6v<9<s
oA@(@.
FW5jHk
 d8EE1S
AF7!mmC.
k{vI=@
qWaEoZ
hIk@@/
:0\We{
N7gc45sv
CQ(OyW
<5Wk.Zw
AcYw\_EQj
~RL&5N
j MS@M
PyG$V-
nJI@li
#kthRp
l= x[(+
/;VDU(9
WI91G`
BNceI	
&u~%i`
G9SgrNC
m!n}7^
>Q0Q~K~
=bK4*3b
u<ao)\
y'@?< 
%1%yuW
Es-12S3
TS2m~p\9(
mB5Dl%
i5T3[kvV
z*APEFMS
)=Nra`Q2Pa
*fqfae'
:nS<$7
XbeYG?
m7:H5MZ
P@{o:5%
g9(),a
`7K("L
{C_00%
3E?2 7
WrJM8Po-P
x	,/^Mn
0Ztp8Z
z\5Xk#U
Cr|4'|
N(.O7&*
Syq[5G
K*V"-\
LCH3 C
<oU$rl
9J)w2I
\S^guF
,ivzx6
 4:ZKx
{a8-AB_|
mn\lqrZn
@3~[HF^
P]nZ"V
N?Ru[\
HfXMS^LJis
?.SL@X'
XB4EgnK
_Zu-@^KY~g
&Zj ni"
}KbD@1
Gt`%ML%mH
d=wkD;
;hy_{]a/
1LfwN%
85_i]e
ml1}vs
5Y69_B
gMlFy/
'tdN1M
l>!UDz
?S{Q.n
!p))Y-] 
'~	.3nH
tA1h.K
r/qWzSY
g;.(+2
.nD?=%0/
_2M3]5 
3o&8s=
w+=9|r
PBre5;
EBB6|d
o,(K9	V
5_vN$&rD
NUq-3}a
b+Ae*F
mE'1Ws
d}7RVv
Ge+M]=
bK@*[T
L`Z\D\
DAo79q
Ep@B>`
{8<E6G
<s\4H|[
Bn*O3BA
dU:U{Q
Thj%x,
SVQ/D=
Pa<h\MW$
T`?W!-
H~rBT-/>`
MHuG_A
j7g~Tv?v
E)dAV1
,^bHm!
Y;Z%}R
W@S)/td
Nti"137
ASAa4<V
qvV,&5
SMM#uB
;w|f@m3
R=|uV#g
@(&j`&
HRc+0M
NGL]}@_
QA(?8]S
NM7Xe)
K7bKt5
|N&%~	J
O	RBB?/.
LfTT_o
->C#8{
PrC5q]
&vz3cR
f>]s+f
qsgB)f[
$_QM<3
vgQ%}r
3RTnDgh
;9|r%T$n
epYLY_
IkEbPQ+
/'rL&N
IQp).!Gb
^<:yj%
]:Fz}J
ttM~~U
/L2T5~
fc|WcR
&tKsj]
D{y28c
ckU})y
zk|7&[
7WZUp(
Oo	Dz=
ciHhB4
XYw^&v
N!c''~
JTas|H
IaJnmP
XG&WtQ
2yYPI!*M 
|OK1(S
*J	`9c
@;_E(#
ER~${l
-X`s(y
T6Mz:_
spB {R
83Phy%
=7A!#-
ZOYX"rq
K|c7O0h
a=@f8 
KgA{KYC
D}pc0}WD
D^}=kK
XHTz?p
a4 6a_
=2=w)F
ubGo s`
xu^-aM
r=g62X
e, *8mo
@NIsn	
w4k': 7
~UAJ8)
Lc:NTa
T7u~/M
}eRh|;(]~
KkyyXR
Qmha<w
q{-|3>
M(goTh
f<RYw0
g9cRN4Hr
;t:jBn
/kLu37
zo:U;Dl
9!4d{(
QZY1?/K-
4J,=B3]
(;vymU
;brnph
+6]Xis
C7EDzD#
IS {{:
]a{Tq;
ibDMl5
]#!GAD
rRSjN:
OUoUUwvx
XDFw]t.?}
r}*DuU_
>BX0at>F
[Qu(:i
lje?59J((
3It(#[
18'XO=
t""{wi|m
$$,C|Y
GIoE\~
hy?]ZC
v)>fLXe
nJj&h`
Wy6ZVm\
7:0"AM#(
x$(A9fSn
Zc[P0*G"
v%_Aw\
u8](z#
\&LJM)6
 c*F$K
=r7>	i
N,zhb]
q!tlkzf
L_&LGx
c{/N9w
ZT?M%g
}^2JCc
trlPTv
[zFpCdy
D]6k["
dm>lZo
W>kcdu
C.&}g\
)<6!8;%U>RJ
C3>]%"
!"VN *c
($*x-t
lK\:;:
-!Hu9S
\5[bo=
+Dy6][
P:`;d'
LA6|)4
WY<PpR
E+{yR3~
W+} -Yf
H5$TFZT
yaAdUw
'n"[(,
 ^RlG4
Izu/?vV
~9*/%y%m3
.T.@jj
9	Oa0~
LJW\uC
M+I{BX
c:-bL%L
)Wg[EV
9TX[	T
7YYq$@
}XV%LRI
lNG#0b{&
SX	;JLC
]/wyD{Dt
8ZJz?N
2WqBNi
"8Cx+`o
2P`we2
z8dE`]
D>Y|zI^
r4<XYo
>BElov ,
&&]+1a
tnTz`e	EtNo
Yzt*;m
*SK\9W
#Z-{?L
dInRiUc
JQW+O|
%.*W?g*
<9i.3F&
c5&nbG@
UNMB_y
*$[T#a
$}uCyjH
f_LFItg
x#6[y\
Aq1]1kV
,#l3Ly
zCcK$T
3k9,rK^
(`Kk)(_
bjmf<J
u0)2Fj
WK?K	30
5]~v;xb]
-h*dMX
Dc:;~Vo
-+_.xd
%N,?T((w4c
lnlcX.
.a.7hx[o:pe
4[!o0S
*]Zq-([
LrT0&_l;Tf
/,B0|dm
VZ{IWv
iVN]B`
yAV[?(
hXv|r%
$F5Y`.
[]EunU
LjIcg=&9
Cu\2Nw
9AZ_7v
x<!N`B8TX8
:!M{}aB"M@
!\b[73
`mSG.jq
'U_3A>c
m<aJ	x
H/5{8Z
G_G%_v
C~\x%fq	4y
M:O'Ou
}l^gv.
.~bSnO\
r1QL/1;H
K#!OL@
~g0asB;f
@Je	&WjU
!h90B?
I|N;8~
$q2JR`x
Co*KSx>
e Q=0l
 F_"uN;"
'DGZ^.kY
lY@:?g
saLh]=
'eelI7
2#<kA3
tYFJCp
s#PsQwT
>WM#@Q
,2DwT=
l<H!^'3
sAr\o}
Hi|NFUT
>!K+jK
[N)wdjC
-Xph4y
0HJ/8	
n>VsBy
FVvQ0z
)+^H1]
is+|I.
V=Mb+L9
`([R{mx
pxj:cF
.AQ	rJ
Yso3<cP
aN=*yj
}\iOkB
.'o@4[;
fPYI6s
jhK,3?
.Z!)$g
5"C=CjQ
TeDtsA
3bo2.W
ial6t|
|yP}M3
FglboZ
F:SGqX]
iJ +,}
)?XX2e
l=PK55
-aA[Q+
9?Uqp>
"M(f5r
on2#wP
&KbNMz
ew^T-HJ:
	\`"BP
Alf60)I
oa/wJK
yOM$o'
t!p	r`
E55;],
.9u&_lm
eKqLO$Rx
uc]&hU
NT/`a;
	:Y9c/
-lq6/g
=Ka^#e
n;=/~ez
&/_a>9
:*uemX
/,?=d-
Jr?H-pi
PZO`(."
6b&^=5-;
8:`|9Z
F6%8h%
X9#Dom
i$h}?x
W@9JB8Dg
'S|?7z^J
>`81Kc5
9r,Y&-]
FU64+, nyx
10Oe%a
Ae6$5s
bymfK	Jqa
f 2s:T8
D\O,k,6
A%0K1,
==o^LH
m^};6bK3
^fVc!85
E=uxI+
{!Dl\>lt
APW8Cik
p}	~`y
m"NZ2b
`E)5.LD
2e@6ZDv
_]6zB9
(CE%eOz
)iGBu#8
[e@Sga
Fc-@OB
xvuQFG
a$ngFX8
#!f-lj|
Xy}\3=1
L?:f#6
 @zsf\
%[7k,%A,
ZV/NEh
oPgD+8
)Um<DH T
E ]*y/
Q/t>N/g
G]_%N}QT/=}
	yp2Oc
fnjCxh
'bA%q=
<v8`QX
l5xKbS$
ulwXE~
s46}Du
x9RnC1
[R/~nkS$Y
-RRpZK
C'IZmI
e6I"^l_
Y>nmSR
Z;%n1d
azg$gW
TFrP`fM
UR6R?s
oxXa{E
q5H.J3'+H
[4']<?
IWwh%<
]fX5WZB1
O5h[zz
h(xb'/
,T Ok h
(Y@rI.
aZqePW
A1^L%>
4Aho79
'V,:GQ
/keBk-
s=+vv1g
t\(l{FW
H`g{=#
Y[jY$w
[0p+*m
1Py}8}
B]/aGfL
\pXc6*2r
z,*R]3
ymjG.!
;VA:%h
`+Xt74R
lXGJr5
SZ<!lx
]oR;Z~
l>oer?
{=TSF:
N;S-Sz
m9_,Ce5
qN5Vdu
$G'T(]h	
hBJUir9
r[VsO_w
	({q*v
pX4'tA~
?x6L</
	Z%*)y0
guj/I#LD?d
i}TuGuf
yxK\j\
 IH9,v
_;%xA[
0N6	Tk
Wz+A`m
dVY[L(
qETscrq
QoCqRa-
TR	HC*
z^Xv(Iu
X1&qfT
[<|W 	
asN*+-D
@36'KMc
cqMQSa>
1;<q5*v
%e"){G
BsLQu9
D?~u0=
j>$s?S
b5DE?P
5t_PWZUPY
][?oL~O
D@Ug-S
A4|=_"Y
E/gg?i
`s_LOa
O.:kiX
#l`9}\
kmU;$F
WT~>V[
FR)MLd
cu5h%#
nAI9ADkS
j#a{4L
4o=n!rx1T
	G7/IE
:_5hiz&
DcF<rXl
3"rZ<5/
uRx@}=
&zK|OWO
=Q]n})*U
qH.~bB
Xx#{2n
XgAmqz;
(H,ihWL
XnNG.z
oBP$YM
0m]+5J
}%o1[-
]rtlMYEFu
G^/[8j
%'0N'"
k@Uyp 
iyD<w2OF
?4.E8Q
DfSG|] k
dd[-2e-
.]HKL&
xsy%}~
~8XyuWO
Gj)~Ss-it}
8*e[@R
73-a@dM
]cwMR%
atvwN8I
lq;A+"1Lsf
Rl!j5#\+e
YzVti@9
5jOc$tV
"&&Phd
r=f<7K
^=QAki
eTF"VmH
*/X-ek
uR-oiKk
(_Tt@D
gj7Yqf
G%poO.
BUhM-G
ivR,l)
HVW*D*
zXfr;4
mF*n&2
pM4RVZ
2|aH\B"
v>iH"JN
`SU5|%
mS6Rc+
h~9m5:
"m\_<F
Jz!z,#
F'(8P&7
(,!tHv
B$_W=A
6*#0wu
Z49,h90g2
IdS;u"
,xA?UI
;Zc)cR
dvmT ssy
M6?94?
h!IMy^/
[dMm&%
]r/wy>$
HbEj{p
=Z8kq)
u/!rd`
v^&4R~
W$Lg7p
M{7j<K
ORc;5ls
UhGwOMkl
7E0>vP
-at^e+
rj!HlU
tx)|K"
Vp^ ODn!N
9S:drM
{&EZ|k9
f4.[DR
QPO6zjoi=
?S#4A!
 .$c^^
+"f:bb
RSH@jL
>Fh1;&h!
T!Eg\[
5h!TAj
!SI{#u;]'
sYdP5X
]^+vqY
1[Q"<ga
&(sGg4Bq
#tEn[V
cbHE=.YT&<lU
x!Po;_
ik"02::
A)S"0w5
6tkHQW
*..[pW
tjhMgv
8(&va\V
cJLrYL
g[w	*V
TY8[,O*
V=o*.o
Jt%iCY
yTeC^0
}tg7|!
Y;K<v6
uQ@Tl\
9/u|4@
Vv+$ vj<
Oe"LYH"K
u[Uj^<
'c+SLC
N\)K,uD9
N !V<yo
cW\(`1
3g;K.o
UVOGh5!
Bf 7QJ
uPuXaZ
a{a(0J),H
N5Gn@:
d4TLv 
4R@M,bz
5@WJ~r'd
\g=Dy 1Z
^.G:Vm
u1,7mE
AE(q=*
cx#)P1
R^f>W3
(Ca' ^$|%
l$*oOs
KT>wfn
N9>knB
_w;.h>
-7,F1eb;
z2|Kos
bPmB?D
>|>6OB
;s7]a>
R3Fr1~
C& k#`
)G3S<(/
rblg<pj(
!Rp3:q
xRy6B>
`$324Ra]
hJ|q0~y
Of%>Xf
ar@=&X
"2xwK?8x
xdq7yQ[
HPld!7
mr X8nfe`
l C E+
EcFV^,
v 8h6~
4ZI%p<
q2xk_!
F(x@	\
NQZzcS
 utX~s
V|r*aQsnw
o$#4"z|E
~=QS|d:!K
'cqC\j
{UB^'!
hjKf,H%
b3	m|p
t3&^m22
oA3l"!yi
'"\)V2<
M&~cf"
~m	CqP
t)7cHw
vVsbGu`_
\!N*}+C
k1/Z&oy
au2%Ibhx
i8a1u,
*cf\bj
dWg&Ha
welAwJ
>ev*Wl
y@U&zd7
(Bw4rM
vD#i8>e/
}@hnw?
xH(*'k}Z
y7+}4dz[S
:MXj7&
3$^O\;
gDu#99
K`b~Bg
v"PW/L
FEg1xD
1K=HJ5
G;!Bf^
8y+K$k
M_({Yp>
QqUt#K
z*Y^ \Xvi
]X~zv[
A/n'Nr
4U	4q6
K72]h=
{#v^|5
 E7x&}
Qt+Hh'
9;>=#b
<^;R'L
vAX(2Y}
7Oa~4Y
l_;d%xk?
\:gQpd
^Tg"oXl7_
7_im@t-
GxJM2vF.
siz'"I)NA
:sDM`a`
00ay/dS
9thgLrC
N:O6|8_
5N A%7
j%BU88
|cX--t
J6V=2(
VIl}Pn{
jO{-t%g
?S`	MH
ey/hC(H
x*H<Ruu
\To3\r
lh`B<$
[O;Jg/
w2><1B@
T`vt|8
lv:eIb
-[V2<Y
Zy%gb)$j
/18P~C
qS@	b6"
 D'Oe@
'$l<Na
}vh!%8
#:+Roa
;R(%["
Aam88+
 g9f!	b
O<$(G#
	1 ,cN
RBa%7'
fff'?U
SgH/7Y
_XuryO>nk
#r)G|H
y2x1H,
07wB6=
F/x&F%
5Pv30Zn
]*nuG+
7Xn<as
{{c1rF
11!.#3[
aVV{-&
,}'bid{
y77\({/
zA 6!p
}oPTa:W
B9`ZVh
/@6lM'
{<~[>g
(DehSo
w16Un8
,w]*w@
$>lL4kR
9A~/A%
G'g@w:
yt2=gn
Q|3#]1
iX?}RS
9#GN&=
UIp\);
f-cR@,
_< d!3iQ
?K 4E2r
BbX#}=P
:X+@DA
yg6EAD
:ndbou
.fXkQuv@
M('Sz]
r$`dosG4
?mZ?Ll
		z=s@
ZI6Buz
`kUe]4
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
oleaut32.dll
SysFreeString
advapi32.dll
RegCloseKey
user32.dll
CharNextA
msimg32.dll
GradientFill
gdi32.dll
SaveDC
version.dll
VerQueryValueA
comctl32.dll
ImageList_Add
shell32.dll
ShellExecuteA
comdlg32.dll
GetSaveFileNameA
SHFolder.dll
SHGetFolderPathA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
UUUwDDD
;3	555;;
_;;;4355
	55;;;_
5;;;5_5
55;555
				5_
_;555;;;5
;;;;;55_
_;;			
								
;55		55
;;5		55
ffff3ff3
f3ff33f3
ff3f3f33
f33f3333
wwwwUUUUDDDD""""
	5;5555
ffff3ff3
f3ff33f3
ff3f3f33
f33f3333
wwwwUUUUDDDD""""
_54				
				5_
,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,,,
,,,,,,,
,,,,,,(
,,,,,,,
,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,,,
,,,,,,,/
,,,,,/
,,,,,,,/
Frqy%;
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><description>MIXEd</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" publicKeyToken="6595b64144ccf1df" language="*" processorArchitecture="*"/></dependentAssembly></dependency></assembly>