Sample details: b830914098989011118fefaa1dcb4a2e --

Hashes
MD5: b830914098989011118fefaa1dcb4a2e
SHA1: d2770d62d970e405a90ebe3bad9d9c7f8e8629c0
SHA256: c8de1a52566095ae61d0272d9f4cdcf6a40a8bdb891f9a683ad14fa428701389
SSDEEP: 6144:PB+CQSptsY34rh+w+czqd99u2JLMXYQ7FQWwD00OdW4PSp:PBvhD3mh+w+0099u2JLCYSFQPD0RdN6p
Details
File Type: MS-DOS
Added: 2018-05-07 12:45:34
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://blancocanariamarble.com/windows/2p.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2X
c0kz-_
`?K]Jr
od2rJ:u
.P	yYP
o5v]\JQ
\"2Z'4&~
<5Y{$jA
3o'YxY
FMtN&Q
nm:G15
HTY}7c
]2.Udy:
'Rxs(X
JPpVeH
BNZ**{
$''5AF
@N]O9i
pSG^8m
fd8tkh
T$!<pA
el$.4H
(&[Ny[
Bykn2S
py&k3)
Pe/5^R
y)9<5K
0s`K,l
xg'x4#[
tN8<49@
,fMy13
O)x8Wyv
h,mmKE
x<Z:gt
GlJ?+{
7FRiXi
-|SX9~TT
0)L=5B
%0AXK[p
?6Uj7@sx
grB[EY
G_5P#*
}-k|*M
ECvB0rA
O>r{m(
 ['|!A
C'T.&)
Vl(0xb
y,EDB	
E41q_L
vc7LM;3
	2Z<*V>
icfJ^R
AxB5Ga
#'iYG)
;zU<&\L
@jOi(p
u(= Z!
ZJnJrmY
 &XO"P
g<MC&9U
2KNb.N
R,ba0;C
=8h~60
\Z'_$_
pl;:$U
63}hJh
#VPYI\
"_0XFC|
V?~F4#
1)Wa4'
):Xop>
G`hbo3	
P 8g~J
X&Sg3}Uk
hGZ|G&1{3p
8=1Ww-
*isZT(
f1H@S3dKf
IF\LCG
&A#J].JU
o1+_g@
>~,!BRp
$i#l\I
Yf=LK)`)
xW5G8~
mZ852,
?E#2bu
N	D(F~
yG"Jz5
rj6.;#!
OHo/Wtb
\	?Z3>
NmMo]p
R^C{C`9
]S7^mQ
Zs|!rw{oZ
=ScYY.:
2p=g	O
%Vi(ZrE
**([vc
eD&":]
NM	)3x
{	H	PK
J0Y1Ty
,&y\y$
e`qrLwl
#:3Sg<
`9G	j[
!cmLc 2
#T&e|n
,u'{9e
-2Gu[v
|`ZC+6
l2b+=J
(Jp/DZ
B^8	3YJ
J7mTe5Cv
~\~K@	
~AtodA
fFS/We
$)&#epy
=$VIb3
=+b';*
m6$)$M-
61xZ#e
 d-USK
fL/B2o
@ZvjC|7!
1 [AD+
	u.k^ U
n[UuM=
./HLHWV
O$c!70
}E|rn7
mwsgOJG
zLdYJy
Z]GlFq
nalt]6|
P&HZ|2
|x~vF0Iq@
&`VO7\]
+8.Z^ox
3yS)w[
H5{?t.
A"$/>t+
{sTcQl)
yQYfi.
;E]cwW
@/7!B<&
s8f-/9
>N99eT
m^L-H-
WIbC.,i
WU't// 
;:2bdQ
t'3Db6
$]hp`(
*[2%{)
^&m]rk
()h)@Kz
 b7Qi,?
-Yv>fM]
iA9={"
-J	Q@b
"@Y;[g
]-7u$]
/e8Dm^p
A	}@7N
_dB0M9K
|5F"QH	
g*FMO5I
loD2zWM{
EhldOJ
04fIA	
)T{:fG
3+^'t 
G|![ys
UqQh%T
	b!<qy
[cN}[Q
/LX#;M
N(wE7=
%zIY_A*(^0
)w8CM2
[[VX4'u
[q"M$2
%HQ^Vsw
[i	RN~
qXskm3
=bErf6
ic$iW0
bjfX*6
E6)M\h'L]
2_4qRU
7']<p9
7o/p?Y"
webaGh
OyuE-=
!w'`T3!
+g<<:,
s@k?2z
fhAc{'
)K|goz
O%{2@tP^
w/{(n'
 }.lOK
zrk2]e
4g{GO[Rk
VAiGAI
2e,??>
0WZ+'Q
qmK4"Od
'U$2MY
vx\.d*
3("%OD]Ht
|=m@Em
::uyfu@Q(q
s-0<o1
$[+T+N
h	x_|0t
Ku	U`{
t`oVQDy
dl5x6K,
MH;`al
0uo|}S
dzmiZD
oz($N>9
EQ}n.er
BZQ%7U
aI1+k<
w8ouRM
#!h:Vw`
cOy-z&a
-=Sj)-
N$t,v?I
rU*BHl
+zP}gwj
p"bb=\
V+qw0k
LBRd~u
L3_sDl
;r5_|zY
J5P@m:u
KyNNc2G
ab\[bN
!zNl9bn
JfC{WSF7%
6QN:U 
Y:"Uf{
<<ZAyJ
CLvK_G
@c<q	{
|pwSx'
_03076
xoL=zJ}
(I*gTONw
4e]MD0
="lK)mN
B&A "E
hLmX-l
 1O`P&
Tz8'g:N
Z&#O}c
PPl 0n
4"%8+n
Y0r)aU{@w4
xwh~Z2g
bvH\h8
YaI[%<
.qu$2O<
	TQ2Z/
7?(KJM
R:M<f+
?(T;B:_H)
U~dR96
Ov	w@z
U8'a#X
y7wfKk
N"ij(K
LvVRd?M?
rq=]|8C
REn9PYYA
s{={>>
v(Wdgy
gu+}-W
?^<P{cB
QmH`z=to
\t|MF-
luXm{jn
:oMZr[
~eow- 
]c@y	)
]LxTT[
~1A^aG
mQ"Ak|
Wpq^0!
a:1	?(%<0
hv|W|v
^#}rUO
)2@n2#
rM	qJ]Lj
#v)[gN
/O9 ?V
v	rtFJ`x<
Dch?MR1
]Dq(e@v
0:r;-c/
Fc7pKp.
Q<B\oc
UP^RrB
- @O~vW2
{k=}Iu0
fX*h)Yr
-:z\9L
Pf2!;:
&p,`;`
/Hc9v]e
z]!FE\!
Kx|Y 8
K`"7;[
?K^(u4
LUSZ1yb"
r"<Pq 
UFEX-j
bah^T/
p|mE~W
@Mlz+O
UNtfW\"
9^${n^
*2'EV)
~fDjW+$2
dD'#u"q
B1{B #
6"NC.^
@!5NIK
,V&DkA
Q/pU]rX|_
{as V6
8B1cu=`
HqD5,m
?u/{aB
r4W9CcH
<U>^ r
6i-	1f
XX/~IX)T)
mMc_mk
aBv1Az
KWe/_g
V(32@u
R=:B6\!T
4IxiQC
k0\O`P6
e,]Bl:
s]N|Q&:
*&\R},
?I55N>
fblTZs>
`ex@=]/
.}hj`e&)
hz_3~xtL(
98	OQc	
jAk"=&
<qg,zw
/J%8>#
:ef`Y-
OzM~k<
N;aZ	=7
/.)d3r
Z[%kg^
Z0(;y?
*yV:n\(
Mb3wkG
7 n,[p
v(2Hq{
%<!5_t
v.v2KYF
Q&8I0H
EKk*h~
fRcDPd
Nwsenq
^v%O-b
{'-!UQj
yWjCK5"
Pqsip*
X*dOrJ
a7Ev*n
2!.1Ca
2;yT5daG
!g^BP9{T
V{1kb_o
j_C/H8
9`D:'b1
nMFp$%
K$ki{OJ_
X1\m:!
JH ;,Bz
pDTne5
R( $d[
T6O"T"Q]
0uO/n_r
zcR?U9
_N's=>
c\S{Y)
G5f6@p
&m(-zt
'oCA,|p
VjwUd-
#X La$
t(>]n2~
n$m>U,
P|vtAb
Er72A`1'
}vwC!n
iz|Hlc	3Eh
N%w2E7K6
OMH\"o
Kd*`"|
I2g1kCh
8Vs|3{
`2&,w5Z
|8{A#l$
l'@^D;K
#$-u^"
C?9VZw
A\6!O[
At)2"ag8nb
,;:Wn_D
kOZ|$4{w
-'uH	Y
,o+!#>Y
o*Shgc
eZ(MY^
E]!F_c
Tu{=D2
}*=DO0
Ui}60h
Q>|Od;
0v$8ec
Y`8:I4<-
2P0hJt
~P|xp1SX
$5iwU*
FQ'W	u#2"
)nTHK"
@ 5-D5D
W^9j"*l
su^' N
A<;_@K
|`__[o
B/O2yG
sMo NQ5
rQlr0W
Q#ka7%9lm
z1?_HX
<t`<"&/
Ymz[sG
hK/`"A
!l,OhN
1]y}(p
Um;bKC
qgbJY^^()U
MP6LYp
KKYW*H
W-:Gf3
L]36.t
MR(3d@=
]fc^cGz
dHY`h	
xOT+E{
]Eq*}]
N1Y|B\
*sxq	EV
vd[%|<f
L*\ F&
IwtehG
ji*d=(
*DhQ5XCI9
fa{KQx
R8vPD}v
n2aMu@.
/<Z(+-{
^=\[n$h
hd$x5/
b4=Jp~
b^GSUP
/D:1qc
o9{IMk
W-90Ol
fr44Ar
'N=2$Y
BMHyFA
v/%QV)L5
zpq$z+
%T;$dm
@fY)~J
-,GLYd
wh~<el
[rh_%^
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
oleaut32.dll
SysFreeString
advapi32.dll
RegCloseKey
user32.dll
CharNextA
msimg32.dll
GradientFill
gdi32.dll
SaveDC
version.dll
VerQueryValueA
ole32.dll
IsEqualGUID
comctl32.dll
ImageList_Add
shell32.dll
SHGetSpecialFolderPathA
winspool.drv
OpenPrinterA
comdlg32.dll
PrintDlgA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
llllllllllllllll
llllllllllllllll
llllllllllllllll
lllllll
lllllll
lllllll
llllllh
lllllll
llllllllllllllll
llllllllllllllll
llllllllllllllll
hllllo
"crh"l
;zl>3D
6kq~fT
scX}+n
X30nD`