Sample details: 646a312a79925ee2c9f5153913416aee --

Hashes
MD5: 646a312a79925ee2c9f5153913416aee
SHA1: 3c71f7acd5bcba7591bac4e5c817fff99fbf8efd
SHA256: 75279db2495a51d6262641aab4a1b15cad66cf958ec3eb50a6855d1aeb2a6a90
SSDEEP: 6144:b/WZmNJ/S5WcabmkVynpxBAneHVFLWFE/eGFQ2QSj/5rNh3r+OfmMu5n4l/xW6lF:b/Smbcpayt3PWu/e8zQodvu549xZ
Details
File Type: MS-DOS
Added: 2019-01-14 00:45:18
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/contentis_base64 | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://christolandcompany.com/nil/simple.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2 
v2.19"
!2._h0
.[{d\&
G`khI<%
@'>i 2
%iRU1v?
 .>/ZH.
."DMR{
Zfohf 
p>{B<V
N49_j|
q9oX]|
]b,|pdV
2TJeu_
[/|4ix
EDZoFD
( nn6>
hv/[}	#
OTGUuO^
+'<stq2
AzdC]P
#7:!rYn
{fO@L1P5J
%NifE/
iFJJP~
=MNon:
MBdM(C
3m[,&a
( '@<N
_1(4mi
];Q(f3
}FRo,i)
P8+$+|
b_9+>r
";m8N 
m(O`le
BmG,$rT
XxMqj[;_d
RWPROT
$SEkQG
hJB5~EV
&Mj/Fu
aMv(nl
=/%i`"2+
 W6x`lp
_f9~R{
4*>fv.
U^2[| 
/K9axZS
L_-@T9;
_*"_0y
|.]qLOg
@rlA?B
!6_B[T
o!S7	U
Ns&wJZS
!]xLP+
^0CwCLDt
7~`bW2
mqF6?R
%@7"jS
DhF4kh
U3)dArT
s+Et[g3
i";ylk
sUv<V<Tt@c
3[|~@l
 x5c_&
w ZWmu'(@ 
'=.L;]
S>^EI<~>
+9K|B?
~FI5~"b
%Q=g=3
+O>%@'	`
X~vzQ$
mDCC21
 1 k 6d`
]y9*idb8&
g@{LB4
tnyY0"
!/	~K!Q&h:
F4ivS<hPv
j5c&+?
d{Lp($R0S IS
\pGpB$mi]
7IzuJJ
6-1.hS
.a;}/?R
.Hv-pU
<$T)m/
Bb`=.vd
<FywA(
I";%[8rh
m:vd-~
G%VIK	
=9b~OG
~LDW}X;
m&&t!6^n
O:w=/	dz
rh2y%]N
Igwo@T
"Ur-*[
Bq_La}c^
UiZb UlK
ijnp4R
O^VU$'
ff>8}l6
XOsoyR
=q#W48
`\)eMB
.d.u%r
YgHi?J
*S	l%`
$T/"y,|\U;
=_u^40q
-D+izA
15)x3${	&
yuBoN#
1}30{5
I2g<IG+
@}3cn-
#xus'1
?h<Ho7(
	Zwpj;
{CgT`8
qn$#"k
sN)pJM
kuzQ#0J
#:@s_~
Da)7IK=
6SkgQM
xJ_g^4
"D*]9{
Zon_^)
S[ee#`}
o-&#)HS
|7*Vg	}H
7T.k#+
*ma}`*
P[#@H`
9u/ZJ6{
H{f{aj
;euuc=IX
m>pyi0
wd}Sq5i
P_2?9y-,
8!6>"-
3#2r:0
)%kO8:
Al 9c 
.p=P3U
MpHD(I
IljbT1
NlId+\
3zqv|BX
xfSwPv
A>r>,7[
T+?@%3(-
)ZFtVce@
0H(Q+~
?%$aAK{59
Wdt"y-
lH+.50
`*@tUX=
"l5IOba
Chi:=9
'@*C%>
FfO)_S"
JJ=3`ZOj
me[#^QJ
Rpm/0J48
Ly i@-
h3Ok;koWFM
_oc3C@;
O2[uBE
"sx!^&
yAHS@C
Wt ;xy
#oMY{U
F1sJ9]>
*sMh$y
Xa~xZk
@^"~5N
Fy;4n0-
.X+O+_
evS}]Q
3'<LHoo
<36u?-
meA#	"
Y!	{AY
Jir(.J
5.K$Fx-pZA
&^Ewv 
5a5Z0Q
gp;(b$
q?4$r %g
[C*K<N
RfEo",
h@pJ}?{
.]mk	A
&NALXPi5
iO<T'(
HW/CG2
)4BX?~6ev
uHY8>j
>8A,s@@s
"G`n):{
]hdfU$B
OVl{p-D
uQlg=(1M9n~U
_:=!K0
~I{~k[]
nVl+pH
4E;{#g
-??m4^
U _[9f%3
OykPx:o*l
|V-%Zug-
>	_@$4
&'p/J6
TtjOjc
898,T(
bqU(a?
l8{BWV/
p"~k86
DvwQC:m
{=yT-d
-2m h^
Iw-pCZ?
l  uDT
81N+,OAS
i3 x\o
MX3Am}
/4SUu~
>:,[);
svP8ps
.uXi<Pc
xH`}t*
If{hJP
lH{@hy
>'>gY4#
W?!Xe0
h"A-NAR^m
2Y-LC8
'RIaFA
J{P9!\
a.QD;s
PJwr$`!I
)%x%kP
^DGy%,k
"}L":>b
WR>%p"~
UE:=Y[*C
o=w>:~
se3YMK
 X-9q"
vGD]#C
v4V#PQU|
sc\j5[
SQWb1k&
RAdmqI
Rv;bzu
Cg(.Stu%
a	|[H|
G;9Yq0
Hz%r[g
C)=tMf
X/$6Kf/
QI\,_z
6<2TNW
+y!xe$
50;^Q^
^$RR\^g
KDN)jl 
85iWU`
A .fsXi.
gFj(JDI
RoyjGJ
4ioz\73_cY
C2j_)v
VHti>A@
|q~hM#Iv
%[3YBi
ID^"C(=
C9|3)}g
U5moT"
F5H[zW
:=tI6K_{
:)Y=D4
IX\!hK$
F|4@%5
c GMux
)ZpQ{a
kj6:sN<
be8i/V
H($s(]?!
H g.Tn
NXA30z
H;+!,B
NU$]YT
i7T(ToG
dBEK7P
 k28T(
D`~~u9H
W9"1N}
E]Q"p)5
Ur<lo#L
(3K)SH
mm#)Ghe
J-u4hV
}d4`Mv
M(	%gH^
X`{fhJ
tS|kDf
IBVh^%
XG.]ZF
oEh~>1
,N>mK:r
\F:3~-j
~FigK$
z@AF2l6T
B%58-}
't~S/n
k#)FX{9
q5EvYi
wE2c<r
X\tg6 
eJ<6&x
"ggs!7
c3zPxI
4I*Y[9Ck
k0"\n	
1%wR8{
^iJ\ur	Ir
],>9bV
oJo{?Y<YE
Mh#0y{
d~b%5W
6O7m$p
{:T)0jf
E)qE}zLa1
&;W$L.
khpMCqE
(#Nl<W
8A3=R>
v\ PF$
nrV8I]*
EYcCS^
sdk,EvT
VNN__yXC
ho_;F`l
'E5=	R>
)qC?y]%t
F"nt=i
vp?mg``d^
hwW5ay
4o%0Fs
m."(s:
F/K~P}
Rf/cBi
.E(=U=M
?AFeYc
g*XVc`
(B	12@
"LYs]\
uKO:[|D
>2b$C}({
QmEE&G
5('xi.
tk&X%b
btZnR{*
o?Bj	N
=J\~*\
9P6c^WQ
(N$i|Cd
NU] x1
;cXi)T
3\/|YN+
e=-kmr
c	HtR4{A
vHob.p
fj+P2Z`u
rQgQ|:
xhv$"Y
W#0B0@~
8[hH9n
x+\28$
|FBp8Z
uzh;J*7m
0Xdn<]
_A#]|}
QBGk2om#
l8dMK(
V!NEal
"!b8HFwh
_fdF;/
z_n[`c
]$OX;v
Q]T6cB
7DD@;T
eaOpM 
TP+J).
u+>Wg(y
'6rr[H
xcYE2(?
GYiw&ZlNf1j:}
<Ywt8fw
(!Tz$<:
rQ,7e	
9we\@PN0
ZB/w5<
.4yJ6]]
z0OJ1v
G)_WlC
L8jactFk
LDO20z8
j.Nns`}
tZOWI	
S,=!V]%.j
'},q&9R
4)OvKu
epfJ3~
$>]vD4
>Z{C:[
_7fwI^
U"a&CN
@OQ6-d0/
.-2j-=
z38zsZ
8v*P_hxu
.;l&(O
W?0W:+
{;!?4\T
yLGkB`
yVs[ R
CbxDcKA
ay?"UYh
hr0wsZC
(!TGC.
(lSO.%
z	N`0I
VHj$xh
+5GwSMa
o31txq
EdD  a
=U}+#&
w=RuRcB
zC`o4k
vKk#{Q5
s#UDvx
>b|#aq
+Ae5K8b
e?NN+]
4NtYyG
io%Ciz
$A:"ed;
]NZHn6
x7mo-J
ohw*KmQ*
'C0lTI
a8`?+3H
:\aoAs
['K-c[
]5}:ca6{
3/k:Fi?
$hR!$|y
kGQu7*\
cR`v	w{
kS}ehq
sVaecC
xrb)	i0
ji<| gW
tTk*9-
d(T bf
4QpyCH
MsSO$E
-)O<lwUB
stni``
rCf`u<
V }{_>
(IG>ch
q=;J?O
d-';pp
"dd&uX
'1Fwdp
13o"fk!
P[D;Bo"
-Qlj,o~
ZPgH$F
Ntu:O^8
0@b;N>
9/5M]ms
P~dvJvv
=YG;t]
C :21&
C[w6<b
k16d}d
O~VJS\bA
?Vo=z8
eL|jwXMV
IXP?iK'+
:0XV,B
_?|w[(
^EZ96^Na
>cNq8\
u5*r882
S2wUS(
>:Pu*Y%|
hilAZ<
P\{(Ho(
[tZ-$`
AA2XU{M
;dZ+TV
%4@[	o*A
@X"pl9op<
 aQ-/a
FfY>U%)
>^,FYJ[
K:60nX
e*[k^S
Jj\}i4
Y#9N+h
UJC=a	d
oL+;u'c
S48vdi~
/U>e%#
3[o	>a
%7~Z~4
kCAyHl
*mxf{*+
"`,E>w
J3{9A;
5n]rE.v&
CxZbTQ
zFi4qo
[".!=W
7n09F6
{VVY'f9a
;LH_~:"
9lJ7cc
5P+$S	
Av10J A4
U4qV1V
yYYrRW
R4,?+P
m[xIXZ
6~$zv`2
EOE'tewK
*~KQ^G
J{[C$I
cg>vfg4
;^Seg	
A	s;iFFI
T3 H"k
hjY4!\
zG^GkL
GI&wK'
S{CT{2
ao/>`DwK
)wb{w(
02B@{fN	0
MiW28Yk
$G8/!,9
VA"VVrrSu]?+
2{|'L&
m\{&AmVS
2l_$SP
.S$[-Kau3
h&'I6$
(Sf65F
<Y fsn.}e
OjuK	zk
4O\#i2
sohMuN0E
6kfT0<
B#Y: 2Q
>}l(Gm\
PSoOAv
S>;_c\}
++p/}(
9e6Ki^
hqP/>%
X _\d5
3j&=-<
h@W6IS
Pv0kB*=m
AM1+-H
 uL,Fx
}?kW=YLl
2jvdnT/fS
OkZlW2
us.R.[
kUIgaX/
8_;>ozem
yySdNvb
rJ$NsY
5-DQFM
[DD1ih
'1Y{5C[
\6;QR.
.E:ac$9
}="KTEN
;z{TOq
st$#j	
|ryZrl=
q(~z*TK
J*Rc$3
!akB7ss
B/fO	^
:CN8k]_
#F yeg
D%>@2\
0ZH~k`8
#B`B*jq
A8	Zk=
r;G`n+PB
fNG-pY
:Q~iW_
qN&h	>
8*W+W"s$i
TW9(_({
epFpu;
W{[+;9
e;9ohv
h1}b0$X
H;'}Iw
w;<$!b
gg*X)n
eg{`mjn
>]ZU)(
vfIBy\]
kk;xekQ
(i!gY4
CL^2K@
3bp,CuI]
I->[~;{s
y@$6Xp
'O7]oV,WN
5W *37
wwgg1>
=P'rPgh
(%!Zo[
~rAh_!
WLh:Wa
eCN7&1
X6:cRdh
i^"*=c
Z~7@Vx
pN g^"/6
dlI3-+TT
3YOYxi
yZ@SbE
3	l`>zs
0s]B;`
asRr:u
N@>9B6I
Yx5w 	
!T]A\0Jn
j'XWd=
6M" f(
4YyJ}[
qg\|Qv
SjXrWD7qy
.yWE?c
5[OUc[
Ds/j-[
w:H#X/.
s3ym[~
JL-=]?
i'EyA'
GaS&r9x
|&eotu
e*V&;qf>R
|FF?.'
GasQ	:
*k~n[A
59.]Gy
LDo}I#
 2J&XT
\7-2k-|
Ip.PQ9
}g	SvI
t.t/k%
r&.s&x
^6 :H'r
XM#%t~!e
B77f8T7
F0.b&pF
kmDjq0
|*e~7#T
icCa? l^
q1'4<v
v<kQB9
`;3clPA
OdO-/)
LSK(g 
5?ut<#y
C1\OI-$%DGJ
E(#4og%
.yQQg"
oAz,9l
G>jUn^
M:-UB5o
E\ lu,
4A+m?\
XrJFJnm
5YgkR!(
:j;760
:TE01<
z	CeD"0,
6HaXK;>
5%yP206
s7$?k0e
F:]y t>
(I''.'
17YCQq*c
iiCNiJ
)hER	tBa
A'`|Tf
G5((5f]
X,@b8D
&)*i,'A@
+e	'T4
)uWw3|j
gQ4h@#
.b,7J0y
fX !gu
SL|j}?E
+gRM'f<(
N-=@lTd
Rr0gJnT
fJQ(>W
u/Yl0Fu
{&&'Re
8trVF~U
:~{L+N
K:+FA9
F*b[pa
0442=N
j6<]3|8J
[C`ceU
.,"%xb>
KUj	"X
v|b2,V
8${6g0
z)CuKA
BAzAuL
rb7\y,
?{`,<4g
v-U 8{
 TSJ	Bx
		W#w-
Rsk42#
Ux<uu*
	3S]IXH4%Y8'e\
4|qrmE\
e}kT6b
yyS}4YO
#TRAM3
X?ggc*
	bRe!z
.VxE5.
IY1?TJA|
	$agYK
HY|YQ1
	%1huF9
[VM]Hz'
xd(bc=Yh
oB%y#W?
OuxeN(_W>7
-_g#W7r;
sJ]|dS
A5/8vf
#,C`h6
MvwijM-do
>]|~z!
7-+K?@
GY^<_L
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
CharNextA
advapi32.dll
RegCloseKey
oleaut32.dll
SysFreeString
version.dll
VerQueryValueA
gdi32.dll
SaveDC
ole32.dll
OleDraw
comctl32.dll
ImageList_Add
winspool.drv
OpenPrinterA
shell32.dll
ShellExecuteA
comdlg32.dll
ChooseColorA
shfolder.dll
SHGetFolderPathA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
TTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEETTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEETTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEETTTTTTX
TTTTTTTEEEEH
EEEEEEETTT
TTTTTTEEE
EEEEEETTT
TTTTTEEE
EEEEEETTT
TTTTEEE
EOEEEETTT
T_TTTTEEE
EOEEEETTT
T_TTTTEEE
EOEEEETTT
T_TTTTEEE
OEEEETTT
TT_TTTTEEE
EEETTT
TTTEEE
EEOEEEETTTTX
TTTTTTTEEEEEEH
EEEEEEETTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEETTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEETTTTTTTTTTTTTTTTEEEEEEEEEEEEEEEE
EEEEOE
TTTT__
EEEEOOT_TT
T_T_OEEEEO
_TTTT_
xk,&Zc1
p"&Zc1
&cbz,f
6~>s2"".