Sample details: b31679db7db878992b4553290a9e6c7c --

Hashes
MD5: b31679db7db878992b4553290a9e6c7c
SHA1: 7d0d2b434b51abe91e5b16e4c8dc8d26143b138c
SHA256: 256c2a409c97448d168f3eb1bfb89af3d259dfc05a510a3f464d8e4b348116d4
SSDEEP: 12288:0MNVzzbgNRk1Lq+TC0YPxfqswK/EH1WYEmMC+jsEdf8Zdq0Cxmj1A:dLE1+TYPljwK/oY9se8Zd8kJA
Details
File Type: MS-DOS
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/win_registry | YRP/suspicious_packer_section |
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2
IO pC 
8%-Gke
9D<eRtF G
ZBBXCmp
|Yr>6=\{A
cLx 3a
0_i-xB
hZ}Nb6
'`\OFD
HR`)]?
TO[:[\*
KLyz73
$PG=	Y
yb;@DmP
QdN\]V
[LB-Al
DzOFv.9
wR>%6L
eB2v	d
!s@pZq
]ys\}a`w
O>M<Xf
>H,U(P
xE+RE~
[S3NQvP
uYo!ZBO
]q<5Y	
aD6A^k
o+0!x+
-0_[Cf
z*N!Fn
zmC7*An
WvyJ{E
c8ucm`
J>P=P_
Na[`u?d
gTh4zni
KA%nc7
_[-{~Sl
7.uymC
30rF>x
M}!RiJcR1q
mCOnpu
AUFZ-h>$"
/{0Nq^
v!b|y	!
?Zl9_e
s5K")"5T
|!x+`P
e0m)~F
XI4gsi
mM)bP'
gv0&mbt_U
do 4*6
]+42^L>
yu[U`J (
~`D`x:
*>q|Qhtk
.ZP30B
	lI,xF
~%	TL!G
BU)YB<
?n[2)'
tPf4P8
yn)(*.
|,JPE)
ZTrJ$8X
4B1g'O
,f'P}L
%,E77D*_
3:P~(W
h$-}2;
gB=2'=
Srn( v$
}n/53>c,q
{qXBwr
"=;LB,
yMR~8h
O/Q|#S|
/n#%c{
e_=a81
Uv4LE_m`
P;hM_->
.~T25h
TZPquMH
)3s07[
?2YVEY^I
l*N-ve
|:K6&zm
&g)QH7
UPMwvw
3l8|o.
hKCP;9%
zKZVgk
y6HHa^
R5G7}U*
t6g1>)
&	G};=
a_;1j"
Fw2Gj}
vu0?W{0
Dx$}\*
KPu#m)
aV=ft{ 
BQ6eFf
:WWLG3
ii,@vs
"DR?A7
Iu24fk
iLPu<yC
F/\;7o
R3kihI
UVCr`J
Np|oF5Oto
'gumq5
5#fh/Q
|Y6te&'
oYiM:8`
U;(TAE
+-36z]TUx
ls@.ZQ
d]gWk~0L
\Ol-IvM;n
UF[lF_
Okg{	[
V'<mrtn
I7XeHH
d"h1z/
*=gT[9/-03j
sIZjZ:
8:Bi:]
!kmx(Y
WG}YA`q
	J+	7V
#`~|7	Q
xZ={kj
+-F ~r@
$&G_^>
)v@JL3?n
}C3aCwF
P2Q:H[-C
tfbd	y
t 8nCL,p
%gMaTt
NL,u-yU
5&UIL.
9^![|c
:p\jhNq
y	BD>/
3uJ`J_
QY|tFT
#bz&k4
H+1-Co
9JhNU71
_/*fd;
)cH$d" 
>!eZL=&X:
kS}I3U
_#_#Dj
QsCi|5N
aPH+%p
B\s[RI
)PQO,G
<\T\Mn-q
FP;,h8
0k7!qr
(@eL!F
$HV6+S
U-Z81v
g5QK*Is
yk:n`}
3N^(.@^M
V-y,4sG
VR583H>W
aMk-QU
b!_6FR\W
&w`A;iI
T,)2\P
~j3F`(J
ua>&)p
bjNZ?eY
B]U^l^Z
o;xwZbo
aB3@e1
N4R {V
Y:rp&`
5ISXKu
5 '5%%B
9NxkV{[
ekwu5'R
N1Q&ws
3pmw a
E]&H2f
#a0-@k
|3xE>k9
3	Z#Ae
{`>OO|
,g="s"
'ni>Bg
kbEt\$
bs!wVl
h5lLx6M
6Qb((y
Y+ID{R
%p*r0H
)Q:|0g
ln'>7Iuk
^E%w6*
9[$+h,
8PffB.
Q+,9a	
.)H$y2A
XDj~Kv
J$nv?%(
GDL8GY
d"@F;G9
	-lA1ellp
	CQ.|2W
GJyhY'
$'\Uokf
~$^H4	
m/pA}Or
!_n/S=
_MW?8hK
<4ZKc@6
["?AG|g
Vu$}-g
>$An?'D'
to6bqg
7G(g*+l
Vb%L|];
"'w:@CW
4~Mm`}%
Di0bp2
\mLpIb
'/lH&W
{?7yfQ#!
&O9y6G
_QZ1t"
al#p?9K
FBlX#I
HQA#oB
Q3.(c~
)r5w-\(~`
@01m"0u0
Op{8UDAP
A@(S<^!
$z77bb@)
nV7>vW
rjO+ED
U;i8cq
	ra_n 
l|~vhaT
7Ta9WP
d5@ld.
prdZSk
)4QZ|?
(FX4e\
C:/-K_8,p
IcB]h]
nfuD1/g
[)#)fE(
Z:n\l{u
;X)2F.
AF]/R|/
RN)-Wl
{nz[|v
3/j5fC
V{x{pC
^e4j@4
8Q5K1x;?
0Eh$HU
n`>%Xdc1
0P%6iH
aK2HC3
LX,6/Z=
g T*wp
>HtoDc
+61Bih
sUpw~_
	k_/%;@>
?,S!8w|z	
[)7KU4h
H?XIEY@^!
a6F_/Ee3
;Tw_Xg
k,gopGO
IhCwN#
\`eg_V
_jC>cf
*FBK"7/
4jd>> 
c:eGz~
InDLcu
-lj,o"n
&i0\}=
iJq]L~`
|o0vB4N
$),M"3
a]kfQ78<
6P7YEqa
^Z{j0O
h ?GYg
[1,{&DF!
QId{<z
y'Ii;e
<lZ3}m
YaR_Zy
`w8ZCf
NUD`/]
pEq2\c
y_I-]<?!
(KWeH9
Xb.1j&
HH}=D1
Q}Pp(q
a1_S$ylf
1`2vRj9Q}2
FeSrh3^ZW
hk5)ha
h2px=,
Mo[he3^
l,)A$@)
/RRRbKF
mtLH|?=p
:sjGSAP
8miSma
s@L,78b
&A2F$y
OLPh{t
VbrY4N
*|^lzf|
[<2+iu3
(n2]RXX
Uqk1J %
=*.o oA
`kg-;D
qWdxKn
k>)/ZM
QZy^s?
Ff;	JT
+M%0O'^w'2
})w>g4
#|FlM<
re'}Qv3
/E	H%a
[_}~Vg
`n1yBE]
gzj)<7uvzJ
C%S={H(f
;W#RL=
)3}JFs
Dn> b/<
G)KMf`p1m
0w|f+$
`@KwzZ~
."9E30
:<,+O	q
R%)k~R
5vT':fl:
Z#`z CF
+Q&~=M
=) CXQ
V*UGZ9.W
A]">Z,
xAej/'
b $f$s
T>t%Eo7
<]M6}CV
]g	!2$
#^f&uj
;d. 3g
XegSdPH
&!JFpJ`,
*L_7SnC
BJ*DI9
A.MKn#
#w[A\{VM`i
'NlJe"
,%{wb%
BO*jW@
%Re^S&
<HFJit{D
=( ZApL
0Q_-r(
`u0.Cc
V]}ZL~
6Heq,v
(IV wEK
LExjyYs
"><WZ{
_:'H,>QtLjQ#
1V[D}g
/'$@|XR
mS3U])
V"IVvI
S6y!R 
1<3m{z
r+{_]#
ppc;Dpp
gI'mW|
n1	E)(X<
QcowAj
gkZMxJ
>:$1$\w
AQ6bqZ
&<`383
BsD5mr(
`l`O&\53N
^_f)_=
tE9`=b
XnwA$X
pOZId	v3
wGx6LH
riNFa`J
U4LCTR
,XO:FRVF7
W&zs9{o
vm0IcY@
p(jQJ`.KNv[
{M?!."Z
8NS*sm
avKx>*
;c4zq#V
hKe*u-
r R1 m
C95D"~]
qzDtcI
x7a$Y2
:GUJSkV
LJ#b,~
S`d32]
R\b|7OM
gNvcVfS1
o$X."1
ub%[f<!q
!tl7EEA
H0#O[^
$Qgw3sI@ 
_QaSVG
JzXxlJ
|^Lz(:
 >c~^F
vb+/f9H
4r)(G%
cO/A8&uI
=).8^T
+nQt]0]
O0(uzM
D']wp/3
3Na`S:1S^z
`;F8Fo
R/FvqC
kI3VUH
(2esQD
dkn>v	
qZ2c\~Z
 %y6XaV
#|@@h5mI
R.?eo~
iQJJKD
]qU	T1
b?Ytt 
<<}J.&V
2:`3yR
UnKn6B
D2JPm5;f@<
-;:XEL
*}XJQ!
Lg<Nzm
tZdH3gl
BoJF3:
b0k\45
N	$E0G
a*U''x
|AF2+]
Dw@N-Q6
=;VaYi
fm8U^"
i(]oB-
FQcv3#
 a"v}~
3dU0n 
.l/U*D
x4$;]g
[&~Gs6
QQK01J*
A\L5W8
.U<m.F}
O!Hp2T
vA`i?T
I8Xz^?
if=^H|Z
(Rs~3z
\:#: .Js
y^^-]W2C$dP
l%_ Vy
}be@Q(
Fye!F!
65Xa@4
ze;j.>:
Jbq)"-K
7x	@OB
6{kp~ttjS
m'#9<.
GF:(qX
2&K B`
tLy\S:
x1r0URZ
=F-++	
Z'tzPr
Wj_vaI,
nEWe9WC2
r6/7)F(
usi"$;
^v;~dy
{hi'oS
0FN'6_
8}QwL%
9	B0_8mD
K(Zv(`
$f+"	>
|fugx0(?
'aTsTo
P'HKS*x
#xqOP?
wywK>'Y2
3yIr^F
@DvTcq
?H:A/9
>zHm|R
R	t4u&
QqFo|{J
3xCK1,4n^
.=&R*y
;{S# w
''7F4K
f\0x$HE
)ZN-~_>
hh%*?Te
O]tdZQ
Fw9	v&
q<#@d~8
V5"b3Y1t
l,K7C4*
Y]]T|Y
E3$ET%6
=XHnXY
xxtWMe]>xA
B4w*|2
!s:'#`'
Z1(ruv.
la}xk~
<}Et@5
1*896h~
7l;w'<
z/7k+^
CAY#^W
\:sw5)
F9_alS
Qk!%47
07-]1D$q
Yp^?Wb;
[&q.w_
$c<d!V
wI]8+1
<[B'mn
&bFruB
GC"cL?
sku#p-
:GMD9w
aD'n=Y
wZq(Tg
6<uH2]r
;l?r/0
wVH,!m
[ 6bK4
1-e0niB
# K0QY
G(9o8,
^&T:	2
nt?ckb
B*\(Ki?
M7?A8e
qP>On)
`P9l4d
=R"_4?
f)No?2
<|b2J*
3)^jnX
 cu.bf
MdEvL<h
i8+-'=Z%8^
^ZN:"-+
%L7| h
53S t8
6$#t/fp
T`s54	
w_#rjn:q
UbFl[d
B_g1:!$
zJ:OFD
xh-s~QB(
V#9.|L
J7lvzh
wh^10;
sq|BB;
sB7w}Q'B
RGEFU.;xw
<OK(rn
j'S3A%_
&D{xah
/4,#tE
%P4`+Z
j@=-a+
U,~ehK
FYy,Q`o
9x]JA*
@!KD1xt
1jQ<Z>
z^Zuww~
H4v^'?~3\
v'8?H{RJ1
P5T(!I\`
U,qz	i
9qohw(
:/521`b<x=4o
T_?B``
DyI|1f
:nwU6X
r/pI3&
vq9va.4
CEW!B?
87A:/L
S=DE<:
<$mcL' 
9G4lEY
~h*m%&
K%(V=U
*O^q/v"RG
N>xHCU
!G,cb!
)h<AR4
B7UcAE$
J:{f{8wY"j> 
'Yj=N+`Q
eZbP`iY
*.aY'5R
*	mRcI
`VKyd3k
D?fCqc	k
CK97>^
dF[}I*
X)Za7F
:Jz@*t
!s?2=)Y
VLnls?[
9F$	KV
{DeL.h`q
s]JN[`'
^]|kVta
&4\U)c
FDrIdK
:HO"V)9"e
?Q\<"R
1s;0hk
t;4Mm3
\,dab4
TWT.si
Q{[T9c
70o+TS
	lr7HuW
?<%">l
B~?Vo1
Oa9e+=S
FyAYEg
e*Y{K]C
b0~(nG
ww!xpdY
	DHhfW5
R;.R[BN
/5A'R#
]MYxo#
hm%!I6e;
$D(@[=
u-i\y{
b3Gesbd
)CS%_1
^ba f[
I*Q)"@Lw
n$Mn}{
9uZ^_c{
V=j?E`
Js&XR%
\TC65VA
q,"I\(
?j`*Gl
}NN9+R
`Y}rYtK
65)b*!
%G0_}\n
Az3?jC
M=U0V^
gq-^6e
*&*2Qk
*z4\Yt
1OF5v\
8 nD]ax`;
bUpj%r5
;5t5mF=P
%y&*F!
1oikW{
uQYuPK;+h
WqPz~5~
)c-R:p
[?aRe~
c;<%jf
bI[sg[
.x!~BJX
{1|}[B
hmwNh~
T@$I\C
B~Tx,9
zA%,&w
*3?2='*h~
|Z"l(L
k|qW;<
,9uk~3
z}/|8.
0)=@|2
)`_a>Yi
V,+n|1(
6/~tr{
,;VWlT
K[@8Mr
hOMP8-
tDGE55
YN1U4m{
96},3C
jshbRW
$i[--Ja
cFZ|z9
X%"w~	
JurvIy
^JI3vf
z9'<F"j0
#X:C0m
tU7*2z
%`? K5
2;P8!{
^X&W|MMl
d0PC!J
EQ-tH]m5
vo)!BuX
JT".EK
cZ/PQa
z_k#FC
3%.=:P
B-X3#Gi
1	5yVg
HKt K|HNg
.F^f+5q9r\
~!T L^
\AM>Qe;
!_<dU)
5pzUt(
*EqJE%
K:~N7X
;q]:%X
vf='sa
))=]sx
rDcbWz
Z%2qo~
4Uxjso
#?nAlx
W{5~7f{<)
Dqg]lzh
l>W68Z
k-b/@}
v1q">T|
e:!AHC{
xlvk|p
	b9p\D
'`{OR+
a?-xpa
z^T%{]
=6H0Dt
A3I05q
"1S-I3c
r!"}o0
u!'lCz
+1RxJ<
?fcCr{9
8-+<*1
C*h4%N
v1kcg+
$,~sURpS
m<ZaxV
$= _>=
pq>Plz
AW`q_:
hG6!<<R	k
+ru,$!#
[?W	&c
kTx}_l
xGM8I7$
?RBUwF
0H.WHp
(K>P.#
HVXx+^
8H, a$r
}Mvl+gI
 qiWPp
k +I3X
uT7?vx
H(	=H%}
V.~-8_
sYte{f
5ts(n 
j(^g'~
UH:D0tf
jsUx#`
+YEQwi
5?dp56
0nQq4-
!lBIp/
fG1ejy	
.ovs{PYe
F-^(C3S8p
LA]i B
XO`,	Y
6u6n7}
`:r@y*
 )3x%7
]Y7G7?
TgNuIq
O-)E(w
v?K|#y
s&Iey/"2
!?aM4 
aP	<z.
)r%R}S
^5.Rlc
<[0)v>Z
BLZ.Z (
 VFY\<
oZu/~kR
+vdg.-:"E
==y.8O
YWnroD
I<p#(O1
W"94wG-
b`].Ut
KL<BGkXSO
`1*TsV
^}p8`G
GOJR}|
LThUMo
^5_b9}Y
)b5NU~
NUa=PW
	,$4ok!5
7.%=UR:}
+." in
>#~?&EL
~$|[zY
!aT3_m'
7i>!U n
rj:=Tf
e(:kI2kc
~Z!ko<14
Y5LCAz
|UZbc`
_18Yw3
z^njt/
"]c3u%
&^,kIq
]a`8{#;cG
F5ABT%
4@WqIy
$ lezFz`k8
~BKlZ3
<0s\7b$N
TZ'$	Ml	
2<KEq8D
[3dW%0
3WU)PlH
'2qhx>
jDspAe}
?p&ns\r
2)+ao3
W<g[]G
b]S5i;
>}My.+
rC5ufB|
u;W{7]
 uCl *o
q@O?Y5?\*
_#lGM6
Jslgw	
#U %x2U
0Lv9J7
[V Z+f
eQ6w]8q'	g]q
3&2E$)
Vqt@;yG
4MQ5_i
\6e$A@
DC'wa{R
g+tF?X4
QDd4%|{6
^EK{	`
V85;?]@+
$[~`Qd)f
5oo-%etdo
(K)-1R
{J4dB7
usN~78
.*Xkh0L;0n
+q;nThh
;0%@lPe
F+Igq 
9xs6/Q
F<${hbz
	ikIOG
cer`\{
!GjJwo
XGt7G<
|)s%L$
MUk8Bt
uM?KxR
Gr!{]m
Hdm"7H
*GmX<_j
)6[~`l@s"
pUzOFH
S;F)&c
E/+i|`
3{B)\e;
K1 76Q
F5!{=v
)=DcD'i
Jjn|X*}vPM 
1X|I'e
n"R5Bo
^htb-2
C`T	?MS
h.voSq
'yBC`Z?O
hsE_leR
&Az-Qr
==xWV*}
jE8 T{6
>C<$$W
X4TD*E
(SNIqDA
VRmmE^
uU_3VB
fl{iQj
7+c=Z8V`
4x$%R{
rI!wL`
?,|`HyE;
O6eLgij=
7;yf/lH
[9Q{-M	
%.?F""
.}LFsr
fL>{k	
7CfWmb
z{9>	zi
A|e=W8
gcCLQ(
m$9z6>H#
"2Vl'# }U
/Q{2tP
NM4R:Qv
(wJ	$b
!q(1}Z
X9G#_H
Y[<Xx%
rk	T\W8
LxOrQQ{
uKYqy:X
-[9|}b
I&CJ':[
ggA[)'
byh(0N6
\9-8'ix
n5@b]s
aAuy4d
:ARx:([
dU;`Kg
{,Y8i!
j|;Q=^D4
pJ[ ])
p"|pLM
B_,p\8j
[t"^Fz
5GqQY3o
(:$9T#
OK.2\8N
n;2Jn6
2Q&sxg
:zJ5x\!
,,L%>D6
rwj%kk5/
(\N:T-	
s}{z+%6
4`,Y8u
dZ|:SJa
JPt5#c
FSy3\-
oxQh%_Qjd
yNci3R+
aRr?	(
acAlphaImageList
Height<
BkColor
UseCache
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
CharNextA
advapi32.dll
RegCloseKey
oleaut32.dll
SysFreeString
version.dll
VerQueryValueA
gdi32.dll
SaveDC
ole32.dll
CoInitialize
comctl32.dll
ImageList_Add
shell32.dll
SHGetFileInfoA
comdlg32.dll
GetOpenFileNameA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
DDDDDDDDDDDDDDDDDDD
=xH:F]c
GQ8wN:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
 <assemblyIdentity
    type="win32"
    name="adobesnr"
    version="2.0.0.0" 
    processorArchitecture="*"/>
 <dependency>
  <dependentAssembly>
   <assemblyIdentity
        type="win32"
        name="Microsoft.Windows.Common-Controls"
        version="6.0.0.0"
        publicKeyToken="6595b64144ccf1df"
        language="*"
        processorArchitecture="*"/>
  </dependentAssembly>
 </dependency>
 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
  <security>
   <requestedPrivileges>
    <requestedExecutionLevel level="requireAdministrator" />
   </requestedPrivileges>
  </security>
 </trustInfo>
 <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
  <application>
   <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> 
   <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
   <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
   <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
   <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
  </application>
 </compatibility>
 <application xmlns="urn:schemas-microsoft-com:asm.v3">
  <windowsSettings>
   <dpiAware  xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
  </windowsSettings>
 </application>
</assembly>