Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: 9f77033ff71d096cce04eda8a48f2ccf --

Hashes
MD5: 9f77033ff71d096cce04eda8a48f2ccf
SHA1: ae0d4699705ec751f69bde8a868d823a131f3b62
SHA256: c72c201328467e0a319d4364ffe4d44529d1b4d174d885a194f385861fccd939
SSDEEP: 3072:9XZ/xK4aSndHOrUZkFMTgf9A2hJvszIfFBrxlma3yRh540N83UtqvWJVUAShekoI:7/raevW9A2gAxc/RTNMrvWfaekvd
Details
File Type: MS-DOS
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasOverlay | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/network_dns | YRP/Str_Win32_Winsock2_Library | YRP/suspicious_packer_section |
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2
v2.17t
kfWB\;
fUq88,*
Yk5nt	
mJL:e3
Z*x_UR
Q,JSgQ
p@I~%6T
3Td(p4*
'`9t}\G&
V8Pros
leci$l
fY)KX g+VB
@ZZ?:`uH
mozOqw
-)'cNu
|kVNbA
O@%^Z+R
:gz%G{Q4
(vk;w(
1l0j4F
rF5W#v
$!8sjq
`zjHu#
YZ45/'
9Ihn{V
L(5xm(H
cY`)0<
&Aah4Uj
{C@aO6
8Sn7PCU
FqWhY(
DU5S@,
*s['PkC
e,e;d 
6c{?.hq;$x
9)H|`%
D4}ee}
>sUV<c
O5~-AjazcU
lM5}}f]
l#GN7B
zQ5*PM
BK}.4G
J$v{*jy
i%dxex
p:FHfI
$g%v$;LE4h
jY~3%`
+	pv$dm
	xWL"q
@->w=	S
jNhax0
H	=%ZoQ
MmZpi"
_I<y(0
#{f-DYofQ
EX'7k|U
BUv5V8
 seHmT
%aN$9k
( j(Vn
`e]Nm%
7Bx%k^
BCe!&Q
E{<ps+
4U~2Mp
Qww`o%
Tm6pRL
\NTn%Q',
Uul\QU
V3/QHHUp
LAA[{E(
fKBY L
.yX"(,|
Mh)7n!
1a+4|~
>1ExE`V
dcpqqk
xtZ>Ws:R
tA4'z"A
;i/SM2
	e0?:bM
O/O.-qHnO
!G9nQ$
]hWpk5
my|C9b
V\7+6%
}>7.@&
4!	?F6C!
&vb/-.U
MiZ8Kj
HH"(=i
E{Kn%y
^Cj'ok
H`G#:H
k-;lo0
~*]Q7	a
/;8f;$-
/>M zV
t'iYK\
P=([pB
"z-+'E5
unOg|-E
OpkzsT
BLUgYNq
fu*/,l
x\>#*B
x:^IGqS
a;,fdQK+i9
EauFS*
d,WMN	LX%
fLE 'x
Q2c%]tHZ
Qo}$F"
0{ }At
)Pt	v	J
+`CDKs
YD'InQE
+Xp/\3
X7~2{H
IZtFGW
`{5pC2
8X]xeO
gu(N>'
.j	v?2
E9/fQ6p
#HfEjD
V&3Bpg
a|6,Rm[
^uhBf`
.m|ZQ<
R]k5N*C
pZl.e9
C.Hyx >
0oZRW%
!<kX5"*
nYh;)T
N|8s>]
n%%l%"(x
VlBAKi:
Z0\o\U
-"3XY6.OB
>\o$="s
\B*cuP
fBE_J.
qu]j1`VSS
$z F#7
6=#3cPq 
[#&BtA
?asZ1F
|Ecsl`o
1rh'jF
$1[Z%Q
Sd1}8_
Qp**.*
EA%Abv|
)6~'EmC
-Aw!/I(l
Itu9Q;k8
~ask['
5%<%BWt
(_=><e
f9B~m\
+31u:^
y# 1ws
$YCJ_%"
027\DS 
;x-ROD
jv9w*dLp
pQmpNU
rV3"CB
>4+*lL	V
7'1/SK
g;4VK%
L%QM7w
N63*g{
zp*5|:
U|xO0S
*G/9h-
ru]7yPNh8%
lVet%Y
al]8am
~1Z2/Ik6H %
It\`<Q#
N#(]^j
 'AT>?
*}vS(:m
<t0JTM
etg{-(
(IpA	eRp
:BA%%2
r"u=+d
aM;K	[ 
H	FkgQc
z}2H:l
4n4G*%
[}3eGl
As)(p(]
~u&tB{
E"/4m,ye
(YxV<h
@!yoj5
w{Y,%m
qmQ~s7f
ZBI}l~
(vl/Tx
)63K7j
(7vcsS
]~!pH1
uP[I7_
}`'O8A!v
aL=4x1
(6D/W5
<jZ<'I4
v{8H(/1
"WS[F^r
-q=yn}/
]~,>d72x
]-h1\y
#cd>ka
e[v9e6
P_k7_ZP
!%dyJ?i
Y]mB`v`4
7UtjY'
7|xV,a
x^tSh/
<qK5cap2z
qY`l]JA
YjC'yA\p
f0kvPYH
4bv]gZZ
J30H}E
$9drF}
lPiEmI
Ib8T7S?}0*
gA 74./
@m%Nvb
~&+(B]
^E5f>y
tbm?rl
F@NrR(j,
&Ev5Y,j
cFV8$@y
3:1Qwm
-}\s0	z
"uhM^Q
7^4ZN`o~"
:/S6'[
`l6,Xv
Gbp7dd
P5:pSqH
RXm~_k
P+`g8.bN_'
$T$oWh
vPi>QS
 g7r%o
pSw#r:;$
uck)mM'
fCCRTSf
:<%w|6}
5o.9mA
-*b ''
!	,1)X
cmlc{hI%4Qq
y1AiHX
qUecS)/?
Ef}Z`a
>"%Vu9
Ko7_:d
8K>Tq\
QU;S(O
UkRsKp
DZSfGU;
_esbMb
h,G=;S
hL8}VIU
0^}]\KN
E3#xwh$0
`po|u4F
>PUIq`
SV:i[e
dVDJ$2
{|m*f3\
]^}{9:1	
~Td)(?
Y2+5ZA=o$`Oyu
b:^A(T
Qhxs<F
XeC(/T,
~id:(t
ZHsFhT
yh4H!!
Pjl;.c
VQE"y?z
E1_^=r
y\?&o%
Ex{Sf}
RkmmTW
=_8F\,
1b0^pE3
s-c@9h
/e}N:V
l-ZSM8;M
 R%}nf
8Z>?$C
tz9]98
q;C|kw
V$=wVa
d\u&G-
DUe.]W
fYk%]f
/5upq)
nS~\';
hM_P< 
 vTDn+
JP	J6n(
d]1Fksw
H>Vg6(
Z`kw6>
rPP3UC
F@\i)W
TJgw]_
v'x%GT
hC!SzQ
KtQc->k
Ujo>A.
0d#-Oe
+oPx6V
VOL!jT
rhBG" @
R~WdH<
CbKXY-c
g^cLuPR
=``]`e
FF\ivSS
wbS);}v{yQ
Gy[g/J
A?M,T(dw
@\;OKK%m
{9OltiXW
to|/WZ
0M6`|\
^+D]]:
n*/C)c0${D
.46{hY
S5tr]zDj
yzV/Qe
fR[ /^
>F,;iA2<
xHg&KQ
]<5|y\7
;'Y3"(
!a(KB-
zQ@@*o
DV<+Eb
\rH3FE
Y #u;F
}b5Ron
+LIsa'
w!r(}M
7/j1^>
pG>uf%
5`Otvr
DK(o*8{
S)wM!\
H?;y+RZ
l]]bO>%R$y
q^l-UH
fnxn#4
\u'_"j
x7\%a,
7+Ni&T
){Qhsv
	h#Zuv5
ulod\+
y>lKmf
/!h@bqI
U8U5|H!__
GjuuY8
I0^8Et
JC>]lk
iU?&sae
A8@$>; pk
i`740v
vjZ?fL
/x+UOul
4[o? *
1y,r~r
E?9a(qW@
^-20tW
MXi@roFU
>uzo7I
,Ds\=J
|!yu\]
bUyoS3,
l}mU7;
?%%[_wh+L1
l3BU,u
9.iW'hd
o8$"t_
$oAO:@
Mg.cf?
vxDNP5
)E-ZbmFe
>;h[4W`
N/9nU~
@cI,6:
}N2^\D
3K=	P%
%'%v<&
@r7j2a(
"i$4L^ln|
?b	fCb
W|X]~Gz
Z!i[`Jsb
I/'G.%X+
b\P`ka
BJ*2Aj
E;}(! 
=	D~*D
\ *^'$
H*.}J	,
A4Fa5T
bn}Dz+
A@nNCZ
~H3MlZ
7A:g~`.JZ
09*E+#
fu|`+BO
8bp2CW
91Yic5
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
USER32.dll
wsprintfA
ADVAPI32.dll
ConvertSidToStringSidW
ole32.dll
CLSIDFromString
WS2_32.dll
SHLWAPI.dll
PathFileExistsA
DNSAPI.dll
DnsQuery_A
SHELL32.dll
SHGetSpecialFolderPathA
MSVCRT.dll
malloc
OLEAUT32.dll
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
"##3+*>)*>-1I-3J*/H%)E%)F,/N13U13V79\79\8:]
,+;42F-,@13K48P48Q/2N-/M/1P23U34VAAeAAeBCe
#"$, "*
*)90.A$#7
"9!&?$)B+/L48U;=_<>`BDgBDgCEg
(#!-&$0&%/
&+,623=YZdVVb@>J
+!'D7=Z@Ef?De=Bc=Bc>Cd
+.)8.)8!
!#-+-8--9**6CCOFFT41@
#>2=Y9Ca4=^;De;De<Ef
"+%61+<'"1
!,9;F?@N01?
 .,,:$#3
-G/=Y2@]7Eb=Jj?LlAOl
# /$!0"
 $/+.<45C55E$$4
2G+>S3D^7Hb6Gb5Eb0?_3C`5Eb
!12@=>L++;
%%3X]lWgxcy
FZs';T,?Z1D_5Gd8Jg<Nk
	++7<=K=<L""4
$/2A]`o}
2C]2C^0A\7Gd:Jg>Oj
4%&:%);<APY^mV\i:CPN[kCQcUcvWdz4@X'2M-8T!,H-7U0:X4?[
,&&>)+C&)>
%>;?\>Da47V6;Z<@]
$#%-!",
8,)C:9S
/""@/-K11O86T
$'$::7M;9O
-1DIM`
SVkV[p8=R
 .LO^dhz=@U14I
*-5FLWZboDLY
;-1`UX
uu{Y[c58@
CDYBFY
UW_HJR35=
.6:L%#6("3#
#*"-'#.
 01FPSh5;N
+'3$ ,
$7&*=.,?#
);8GOO]sp
!!-55A[]h
$:CWes
N\o6?S"%:A;R5)? 
%$.)(2)*4ddp
;=O*)9
Yg}%0F-2GJG];2G*
),1ack
knvY[e
JTeLVgX_rip
hf|@>R.(9
+8N (?
%$-7:?ehm<>F
E@UB=RC=TJD[PJcJA[5,F#
2@7L90D2(8'
1+6LIRrrx
9.>6+;5);<0BI=QSG[VJ^UI]^Rdg]mpfse]gF?F#
!8/CA7HH>NUN[SOZihq
A69K@CSGMdX^pemujrqfpaXbVKUUMT]U\SKR1)0
&D>Oxp
MNb42H
+ "+ "4+.F=@nglpho^V]JAK]T^
!63B2/>HETvq
c^mrm|
LPcRUj
2*4B:DRJUvny
e_j)#.
-*3hdo~z
bcqkn}9=O69N-/G!#;12LEB\
2-683<1-8"
;49@:?NHM
C@PSQd|{
OPeUWo:>W9=VOSl`d}
pp~ccq@@N
$/-9:8D
!8..NCE~su
VOdJEZSPfeb{FH`MQjHLhIPkZa|fm
_^n77E##1%"1
'<8CLEL\QS
QVeOSezw
^[uIJfPSoY]ybi
\[kZYiZYiWTd<9H
,&1/*3$
(+&/QMSzsx
+)#.WOY80:B;B
*+#.A9DG?IVMW
FL_PYm
IVv*8U`k
vjv}t~~s}
]cz]e|KVqEQmft
!=RZwU[xdh
[\qKNcgi
76<YKOl
/6QTXu
Y_l=CPqx
:D\)2M)1N
^dwCJ^S\pPYmlw
PTm.5N%/GFQls
##3)*>-3J*/H%)F13U79\8:]
*)9$#7
"9!&?+/L;=_BDgCEg
!#---9CCOFFT
#>9Ca;De<Ef# /"
 $/45C$$4
2G3D^6Gb0?_5Eb
	<=K=<L
2C^7Gd>Oj
#&&>)+C
(;?\47V<@]
V[p8=R
*-5Zbo
uu{Y[c
CDYBFY
!01FPSh
;=O*)9
%0FJG];2G
	),1ack
E@UC=TPJc5,F@7L90D'
1+6rrx
A69SGMpemqfpaXbUMTSKR
Z_nMNb
+ "4+.nglphoJAK
63BHETvq
02-61-8
;49NHM
UWo9=V`d}
_^n##1
IJfY]yS\wgr
+WOY80:
vjv~s}
]czKVqEQm
=KhRZwdh
^dwS\plw
42F48P-/M23UAAe
!#---9FFT
#>9Ca;De
FZs,?Z8Jg
4<APV\iCQc4@X-8T0:X
JPcEPd
[]hLVg{
SGMpemaXb]U\1)0
Z_n42H83<
UWoOSlZYi<9H
)A9DVMW
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
29O6Kr6uzHkbDn8lgK2k