Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: c12f2a46f778e9ac994f7a7b77b6ba75 --

Hashes
MD5: c12f2a46f778e9ac994f7a7b77b6ba75
SHA1: e8dfb3b5b5f0e3c036ee655edd6bb142827beea9
SHA256: 4f8a678fbef18d8d2271cb577a4db3a3d52cb4bfba167d364824e29f9dc4e6d8
SSDEEP: 12288:XksLwGxbBpA1vk1aR9rnzRa7vpe+avfNlU/Y1pqJkGm1fnlGRK8Y:Xk4f4c1y9rn9azi4gTGkP1Ng
Details
File Type: MS-DOS
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/contentis_base64 | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/suspicious_packer_section |
Source
http://198.55.107.149/cab/sts.exe
http://198.55.107.149/cab/st.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2(
X#n'-*2
|&7V$us
Ep&~VeP
\|pn_3
y1}>9z
OJg:@b
>6C <B
(c>`1@
V}/l6Y	
kbm+E7
~aM=#-
5Dlz~T
g='o/G
}9/5Is
+jA7Ar
7$N3 9j
	T`Ram
}0%|u*
7U*e6P
_|u_b7L
;>YfBi
%u;E,5f
yV%SKx
oNC_WR]
vQyc(l
,^L6fxn
^|Z,Tc
Y@Mdu$
h6B"ne
k5T$"^
$t)fnI
4tp} Y
O$-!<l
>^pKk0
>dxnktWV
lnkUa%
U+XZ{)
B+{C#>
gwjKy9z|k
mC2+^;
by{M3u
b))IiS
#zz8Tu>z
X8m?b%
+cc-o:
`M[9Jr
16Wb9I
2r"2_R
uJ:O$F
vQBngL
s8*b(mI
dM+<,'
TW.6iI
@*~Rl1
108vqC;
TeG){mNVE
KX9d9UB
gK59W1:
h>c<W:4
Xj_>a+
v2Aamx
Su8}wF
T=%]z{
*WL pHU
KJ1Hq2
VD0+2q
@pMn<U
A rfc{
9b7sO1
G.Z	}H
QUV,;hJx
8.\4>H
Oy787|
RK1G][=
n3BHY)
W+hPT.&
"OZSL3
ZBIfN-
kDa4RN3V
@_]q7H
krF]EV
|t x6/
O!kUw.
Ml^dym
3QHd#Ms
ww}9C`~	
Q!CT}s
@cS*S-
F/7}Dg
ck}5k/N
;?P$cS
{%)sM/d
:F<i#a
'"_^>5
?)qB?%
B1.DW;p2>
X[Dk|?Y
OK@tu@J
%RKON??
omk6Zda
5-No()
q]4DOV
Vey;`{
tchL<D/
ND%0w!i
+UIY@"n
_/g.?b
.8?yr4
b~?tuu
$SN ?5o-
%tI-)}
Qf_PL9~)
#nsMB9
:Zzz5I
j$N7'q
\fYT@'
:Ozt#w
a4K|7T
{UkT>7=
-&,,O$
Iu}O Ke
}EMC8Ix
2n_8}?
3x.Vw2
?9^ +Xhrp
Ro~`wIhrLxr
,6xZ'f
)}#C|X
k6}msh
jxvOn;ff
6:=WoR
l0LRpw%
)gd:,t
nz)V2#$QF
vyHEIe
rMlV|n
z)pYGqP
VrR*zT
n<6YT`
"vHm0d
9C|P77
2xUUyN
U};s}/qb
IO}^sx
ggSkdS
r7FSE,d	r
"fz^>V
<`=ZE#
?tLlwx
K#(?'_
&9]BY@}w
Ge`@+^h
E-O&Fs
kE/"[`
J!B<]1
hn~$DK
mvQ;0|z
G9R<:XJ
kuD/[M
Slw:qyd
=zpXf&T
KkGB8*
>h,32Uv
.W%Uf_
9sl.jyi
-F7;b*g
9OFRex
OjW)zsJ
#s'%c_&
-qkKbb
7PQi4p
)Vk4;\2
RfVH`+
}Iz(3_s
a{Yea.O
xmyJ=f
=/\te(
rXZhU?`
U_!=|d
h,p9`58
4r+t$G!
hrhUly
nD|.Ve
hEb7Hu
!=6E=$w_q-i
}D4E#E
[yO%Yg
~S`;tr
UdnP:p>'
dWIa=i
dpzl#S
	rNA6	
%KL>wIC/H
mvcMq3
A(:KsP
;b`:a^
gJge^iC
v@d&n@"
*W`)?(
Y]!y3Syh
-Zpf[q(B
{!mX	]
@SUbbC
Q9PM>f
 0^1`A
+;z1|@J
 7GW^T
<a	H]^#C
ox(bA4
oPc+uv
<0r&r]
4g~a9r
K2%g6D]>
)u()uy
#J@N7^
Jan6!]
OC(E1^[
u>(i&2
<M'E3+@ 
:*CD+^g
H yC~GB 
<{J:[-S
M#_B3T
"[he'G
t)!ECZ
~W,;O`
6M:NG.
JUF:HC
%$GeL[
vA[[;a
x6TD[O5e-S?
(%Y8Ea
)?TJIP
X'4?i1!
SJ&o(J
ogjk;#
|uAdOU
):"'4`
-QE]J$.he
+c#/3I
RDY$gr
JI`iT[
C|kS2nxM
uve=&Me
A{r^aw
#Z$v}N^
}K$]Ty
,U,T0f
yb=sf8
q. eR@
 yrl)x%
%YS@t2
ECd`U\
/j_`/|
wsw	T9Y
) eWi?9:
yw-],!
E\ve8(
lN22cU
?W3f`$
OUJv%B
t 0Xvc3_
UC#*k#H
hc3RP2A
e'dU %F7S^
18.8&@n^
70x"ZK
l:LX9m?
HkQ:/._
7&cqdBMa
9Y (Bu
\U&H|Ml
vU'k1k
^b$NT/)C#
-6@VkrU
5-( e%7t<4
~x^@)R"
0kuFIm
VZi	`!
JZ(x&U
U"6VM\
va8L:~
k-#Ask
14:{0ur-
!;fG3k
&t0fHP.yeyk
i^`juM
VL`nW5$|
SB0B T
@xr\dct6[^s
!~\IrD
	~&k[{
5qE]0_
:VeDjV
PshMT{
Z:"[JT 
10i_wN|L
}z%Khw
^;58m=
W=_=@#}
'UaD6N
]l'9"|
Nv-{(8
7@-FIe
Vz&<<?j
O'$bEo
-J#Yyp
$Ayr/5?
Wg:5u?
h@tq+Q
h3sMA[/
^bdpGg
9-	&4L*
c#1z^'
!dJ,^:
SP>4_'
\2"=v^H
}[qC~	
d3A#5a
Hf#O`U
M+*E!*
&N%v!XT
^<"U{)(
RMljs}1)[
[d'eBC
+.v-D;
9T/eqP4
vsHXOj
/U,	,;?
kKl_$<3
HieodsK
5nLkj&
aQpd3[
 	?<$>h
J 2%2hCee
$|'zhV
4w/Id0
M}U\	"1
WRKZW?
q!66^i
~,;b	%
9':TOYWdk{
\TQ+e'
fgJ=X}#c
RNgF)s
zq/|mpV[
E>ek<7
b5&oN@
F)%^@X
|Y/CN]
IH<>mN
ojrX'$
cj!)pXc
MBp4\^%Q4gnG
r]MAQ	k&
Yf4BwYa9
.pyUn%m
*WHoe~
5`\?3e
5'Di,b2
PUg)bW
0H'&AO
srUq>h
wqXsmet
I4C{ei&x
BV1D[Q
rMAHK#
"*Myav
r7xBiD
s}fq<M
_k3Lw	NI>
eNuOua
__F5#	
yfY@&J
~aNszU=
hsr{7NmE
KK}_t1
zfpd9	
s:U#zc
+Vakj9r
2l;S2Q4{oR+e;	
+=y;o8w,
GA/Ua%@
7(^3.^
OF%\sr
8Nf17X
/^9bZbt
l`(j<M
}t9@_1q
j/&<mac
~IkUtRJ
~D)Ke!
r3IT8w
HPqYl"
qpL5(qmD]'p
<8!k:=
$72>fS
`Vc+uJ)
S'I<1W
sJ$mr3
]-{F>?W
Mrz/(SH
Dwhbqu
B"SzWa{2
vLnH}ej
7@,E>P
k"[&Q-
]ma2>}=
vw7&~Dt
I>YOg_
0onreV
/b0iGw
z@m,J3
2*j)@^
XVIlD5
*9	dV[s
gZ_9Lu
^?#qu"=
U(7	t#
YE&gSY
>V:kg'J_
h"!r1o
)6^J/0
j|VCG@
2wt21I
&qHRh8
}zH7OG
F*i/SF
UmNOvNw
FFnzaY 
k zl0A
Z:\8<(
O@q(7x
T	YBxO9
6;l)mCB$
nGi&62
7C!\RQ
Jj,!mpv.
\7KF>l
[iB,JB
Cxum{g
.x|(11
O q|V?
1w!Pyog
6vuYNW:
RfR0	0
gy*(<>
OIL):Z
(C1'-D.
	Htiw8
u/hO6x
6S:d@s;
.+@?f[L	
	b}NQm
TVTnrQ
PED0D=k[
GfK%i"
XYFW~7
3X>IlS)
*o;Abn
jJQp5Z
	kr#M9
Ht[PodQ9
qVze	[
JiE13B
G ~`Sfc
~]E	gv
'w(6iL=
kUq8>A
[2)nA~Q
4`dcU5
[=OruJf
g7O73%
=e:<XJ
M5vp2-
\(G~-r
gYsJ;9
cyiWLqQ
6zS=1suK+_
?f4LUm`pR
\jHi0(
`"LRJI
#BTW;K
B8f6&q
hgD7(y
i/:cDL
;42j_k
*PCaXI;
q#QrC,
D[amQc
5n49~d
#''_"2LzDF
Y<[:m5
+O5)eT 
B$b?{n
?05t,]
quqcwc
g#)L?zH_
":DQoC
!.MDk(5
Q&L(	j
e4k|mh
Oq"w;U)D
L1r)G]v
8p	[nA
u	WPxS
uNINadO
]u@]^7viD
ge!f;C~Ub
	9i+Wc
66/}0&b
P&#=n7
,s7uPC
7KXbsj
SUmt{4
-MzpV_
4,crN,
MBeC&	
M6M*5&
V3~}Cuw
|R2	PW
bcWm/+T
I}jZ*c
\VL,58
,1P{Et3
z	4zOA
_r_By_<
eszRkw
BzFT%$~[
B&9:JD
K[?2[1m
Lw8}-f
W:;.%3
'lU7;g
`lwF.Q
I"A,wH
c/Nc&`
II'Y$X3qF
42QR;c9
e<9*_W
{f<5zVP
U(zTqj
j?~44R6
o'?Q_J
'Ok-~m
q%S#xA
e4:]XHg&
)Q-}	(
JLI}%5
v"&f>j3?
TwhmBN
zxg8bo
$'ay<zca3D*T
D`k,S]j
WF9JJuF
)A:# ]
!O@\vz
Cb:/SR
~G7PSGN
W]D5p]
bhD5g`mM
"Sxk<=
@}>vMJ
U%fUy}}
E:rxxb
kX*oGl
p3%4;v
=d.Qmy
Je#_0h
<GA. 8C
x^mV:]<
uESycvf
ZO`oRS
vp[j>qM-No
e;LqpK
=8T>AS
hz^\oH
b0HC3e
-2 ,N^
eqZ<K+
uN,d_G
L!9No7
FKGhDY
r[_C,?&O 
U@3>s6
~ZvJ|y~
FIRl2w
Y?	`Zn
L[fx>a
_(eh^3
Edz?ew
(_j>:g
qbJ3U'<%?
?4_N3=
x>zIet
3QITk/
f=\p`w9
E I>\{s	
)31Do!
@aVZn;
wKIM]q
UvDVufk
`e(=Ho
KQ-M1t
BT-!_N
^zS'`e
dBmU^.
k2h4PQm
sIVCz%k
nL4V7$b
0ojU'&
g5`z7-
gY5G`N
=92(2-l
4mB3!Fk
V!sH/f
ynW32&
usWO*5
F[")x`
y5 Z?1
}q%2kKu
FN k(6
k`P8Qdmhp
Q~XhAK
V*>Z5&
Vka}K=
h~H#	t
K:2%*=
(@ABx#
^~v7+8!1
 S!^	9
Q(HWhz
WuKC/^$
z*8q)5VN3
	9:O1D
~f	.K(
)A cM6
]N|e*C
=(b9{	T
w->v](0S
x@WOED
R=43WuL!
AHpI+2
G"bM	Y=
bhT@/)
j;N/LU<\N
ji#a4M
la_D.rI
moRlN,e
p!^s	lg
/LQc=sg
|3;n&Z
%Hrc^":
2t7v+>
\WZ8yN
Wb(1Ziv
-4,Ga2
dW6JL~
-gv[B4
q_122t
OLZ%fY
6}0,ME
0q=Yr1
`nxwP%
BFHXbW
?jM'Mz
{QO.O6
R)AT{Cg
U=%C|	
GO]_1]F
WI(s/T
H" &#M
l2QADS~e
_%,q<i9
JbnQJe
dn)nK2
v"I^3k_
g_$F2(
C1f&?ID
_/ms4Y!
ee)Snv"
g+&3s!i
V$0Xw5
>t;z&6?^
rp	PNk
T1Wi>@
L+GQ[u
MpPwS"
:aTnx3
w4B-6_
*Xdw:$
Xyb}K$]
Tq-"q\]
xq`$qsd
1g9j4`
uep,,9
?N(1W>
"MH5di
8hbE='1
5rXqHM@
vw5HnP
<8c!PH
Y&x23f
2&Pim \
V.CDzU
])t83;
zC&7oo
oNwj	{w
gu2!vW
HTSITR
*h4vI^
P--=x`3
*x:@A[
tTg0,u
qrI4RngM
Jd_ZQd
p!TTyn
Ddgc+}
O_SQ0>;
_heGT B
h5Yp@\9
k#2#dx
}#-X1x
E,Vo:U
NIfy)x
s\BP:/
#.0N&J
$<H<TM:2
Ov	ap	]
#[k6]O
V6,Zw_
fW2scd
VLY\nj[
Zi\73'
8F]9PF
dcXFW9
]DV6]s
dC^7vg
y3Px%`8]3B
HxI1u`
i@_2#^|
2>RlZ4=
G16tf/o
OGRHT*X
@*qgx.
P\6VM|
]l#,uY
K[:&oP
;O`f($8A
7V2=+s
kp*r%]
3 5u+B
^g-P \j2x8
	*<.&x
qcoc{ 
tlF}7%
aRg{}m
;H~hWl
`#Wyk"
a\GzC?;!
jgr$i1V+
tycVMlx
LY-?YhD
H(Q/:/E
9WpXB5U
`-7_o:p
a >m'fm
c}iE!'
Li2#Ag
ou\atB
2'DkK3E
?bnK=jE
PBJ	3<
\\1/4@
#z`k\$
,_n<(x
YQos-J
K~G:Tr$
EO!1qN9
BRGU95%$
xH`V>D
 3;E7g
t/uG!-
p\#V1W~
@~DrPtefb#7e#R
 K>2zd
)!Galx
?MJk^+
_K:q)g
MPKxtq
un0=c~
[?L Nu
!(	Dx8
^ztv9yN
R;A&O0
J:/4Och
\VPs2\
(DfW"F
n5h<Z@w}
~dBhmX
/Y.4@zap
Z`kVNg
/N!b8(Z
*+Lu\T
EqV;DE
m,e/ko~8
{ v^$@FP
Y8g^lG[
_2, Kv]Q
WA:v,9M
fi2iK%k
$2+ys4
FeiP`g-
OJP[)c
@#$kcL)
(*kNl_g
WXM8<(
aH.\&L(
|NEDI"
0li\&%
_59l6sSO,
L2<CKE
G>!1al
VO.j1W
e4v*e4
H)2Q!R
AE>rNT 
	n)jNz
'Rs$_@aj
2^8=?;
^v/Xyg!
A=LP+`
BsrlL@h
`V8z*-ug
`Kt<VG
'oT=tz
I7E;tW
=xnsHf
>)z}o\
R^;Dy7
">q0abSg
@P'D\-
ct"Au^
F6kP[t
iv)LJyEl
U jY)l;
D2$oZh{
JM2mK>G
	5B!yk
u._0MI
Hn%3VG
?-A,J?
IpfkG 
9)HkLb
q%j 	U
't6(	cJ
%L%zxF
bz(9/_
aq-[In
[EujXI
~e|{KP
L%WNQr[
c_KSa8D
_r|Dhz
HP)jgW
x1ZwVx
n+aPdRy`+
znXt\t
.0Q[CD8m]
?Q\Gv]
,JQfp:
eB;X:h
c?LdA#
KiB0}$]
Cy_nTB
#0+/F.
AaCv 6
HD#lK1
;JdCOe
G<	#u!
,|)oLG
jHlX6C
-J2Qkr
sFqo4Ie
rcnd("
.`7S_I
`M?/xR
/Td7^A
sKg]d*
#J"9fA
UB _c>B
\]BJ?r
<RSUZt
Hlvc}e
05l&)&
Bw|D$v
.Lao!b?
%'c'@m'
 S:oYY
tcrE4$uR
'R>)IYP
;;</_x
E_7Vz7c
65n(yFg
vp?|k'
h'n'Cm
A9Q+u5
@!n=w?
3Y1EH'
52@(O<
=23'dpU
B	'=j;
x&v5j"
<|c<KD/n
u_~1 |
|b0M|-
_qd>7f
5DBwU;	-
tY:h3C~|
!e#%%')
y)$aMB`
.xl|8vV
p2]P!)
^v=G+#
vg>6)n
:soQuM
oecT$@
>VKexf
;S,*PXSF
&T23m*8
o/?PcB
Psh4B6V
& /1KU
?9FK5b
B>{<f;v.
UWcZD{
%9tIxDNQ
}_TQ*B
	b2O,`I
I[#!9|
V5RD62
O[/w^|l#
MN+Hh6!
29y^b.
39=zYQ
}A<3FU$
)yT"d2C
4wi)!$D
GDSB(-
@`	'{3Q
Nh,[Ip
bV	_BJ
.'3VE7
(@cZ)l
(n}tH?
T,(p3~
fTzaD[
kE-t:|
9x$C`QI
[kFWJf
mQ"J4:F
=/x<8y
4:-}P,	
|g(-eS&
QG.{Oq/
,39W_B
8(\y=\
J%&Z$8
IV6l_u
}iK d`
7a3xBk?
dLxDR4
5}8\zY?
MQfia:
%F+fso7
yAdJ=7
tjpz8M
&Zk"\;z
_VpaX 
gjCun\-
EEt#~Y76
.AVPfF
}BQ(ikQ
v/a}wX
/(Id'#
?NA103
Ycy+1g7
$OVXrO4
+\4aD[
J"SX6m
FQ%_Bj
nR,."[	
YUN|b#
@}Ehb.
pAj|2@
c]nLo6U	FL$
@'b/#K
z<w{4.
:s2:JD9cA
]p\Ac:4"
%td"]Y\
gSEP:,T
jt'QH3
wL}#`&
~0SB+L
3<1p(Yq
po1%{y
.d&Yi%
#$=	]-f
R.Ib+}9
fd`&r:G$1
QH%zK$r
8IVuG\X
p*T}'CH
9h,%P]
6rpyuY
'saW7?z
h6o@Bn
-_u?L#
>:='u1
iK(=R<:
##,IpU
sa79?.
j88{n}
:fi#U&
w	"^f8
TafW^!v=b*
&aDumF
vzzwi1
Q<=D>`
)a?7}.[bz
.t%V=\B
Fj[ou4
Lpq:*3
AKREmm!
$kQQJ|~B
2p8j*+
B&p)/ce$
{*^v610
\M<:5v
zXwQ $
kdu,Lb
yD^qV(
CbM|@!F
$/Pdrd2vw
`=6[UD2O
kn}+.f
5O!U(y
c}LO9]
6Z&ygF]
%qs~^M{1
*#Lf9q
:c'qXF
dUq5{-&8
Qh^LQ#
	'HZds
nrJ5C]
W#GeQi
|<n%o2K
1c:Zqaa3?
^zc$ll
mw<-fuZ{
n:b}Ay{
A-{;BC
Rv 286
zp da5
_Wc|Jx
^.xR66
/]P4Ig
D9H>,4
N/%6Y]
h+"!*=g
I}},3;?
>o/[Z6
RXmS^ F
Jur;AH
-<L{G-
O!~\y+d3
e>5	`"
$Nrh?r
C0p3G9
Z~=h_O
f?(GL\
?.p7;8
	hL I6
&*|/oJ
E7KB#kZD]
BZ9$]hpKc
7@)^=g
@I~&&)
He`tm+b
A:d2'C3
fz97lT
:+u:?v
Jx(jmE
J|e^+y
?^zLO$!
3K3'VH(/g
"#Lh[!
,j&CIrW
B*qU`N'
ZAsc=R
vx\-jI
wRb(/K
h TQ;?[@
#lJmHl
OY,V$_X
XmSJ*s
Lt)\^#
BG%*]5
-pWWA>USRE)
S2*Q&9
,7iHG=)
Xqr*m{
rMWzvU
ovBiyJ
0zDDk9
+UEr"h
#ON@Se
~r@cEYP [,
UUk~	H
ny-Pgy3W
11.Gbx%
9m||.\jh
[4J77q
i "b#O
j\_kg$
[YjbT|
lRw9<,
]XxQOX
xY$svaL!
t6Rw[~I
+O=PfQa#dN#
!/gTN?
kVgH F2
d#M% E
(Ab=R.P
*,N?#x
;O8Z8j
*bnk`f
"b7yR{"
|b	<6qP
xg:~WW3
;.(sfy
q0RBY\
X5ipfy
{21!u0K
OQ:n)P
oEkR]*
<k1 o!
<:~x\;H
{K<1l:
?T1H{O
ZmP:Y-^
/`<&q/
xCPS-^
%fN78[
;1 JOk:
9{;jp,
9ts7!:
b1VG=?
$dw?ZL:W?z_@~D
6	1eSc
X@Sa~g
YRGSsB
y7>Ier
J(Q~&\
eP=oTR
e5tMGp
)x7=KqS
n:1L'N
v*7kMVS
+,#,rQ
wRnf>U{
gdX- iX
q?D,8{
+j J@LO
e:(b[aH
H5zs[]
M.	!YD
QR~qI}
Y$-e(r
[~g-KR
N91)M[
+Z\E|k
;B&mk#
EQL2x[2
>x^`.)
bC` jKp^
Vx2Cf3
=A^<~RD
do51K)
i0kakp
$e&5WJb
J`VKso
_od\fa.9
OMj7hm
yCXnuVS
kwA6`X
7o:GN:
5%<01`T
P<%6Q/ 
<dwIT>m
B7+_=[
~D=Q\XRv
bzVrTl;
H{KzKG
}1Q/%62
8()rnx9
P`A&Y/_
Ef+c#/
k#Vq^(
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
SHELL32.dll
ShellExecuteA
WS2_32.dll
WLDAP32.dll
WININET.dll
InternetOpenA
USER32.dll
MessageBoxA
ADVAPI32.dll
ReportEventA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>