Sample details: eeba08cad1c4f2681210e4eb25fabf0d --

Hashes
MD5: eeba08cad1c4f2681210e4eb25fabf0d
SHA1: 0f4f506b9119739052a8e542a017cde9a3f3c5d8
SHA256: d874fca69a2e1c3938da14b4febf83ac2aa05a409a85bfbeaffe3868582b893e
SSDEEP: 12288:72rW6zOV5o1p10iXwoOWUfzB0wYEWHrkcZ:72i41p1bgocBIHrnZ
Details
File Type: MS-DOS
Added: 2019-01-02 18:59:24
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/contentis_base64 | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://secureaccess.ru/pqcrk/svchosti.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2X
v2.19+
`gD#Gh\Zp
Pd!'k$
E0qeK1
]PjkCv
:ti~u-
Ub6v46
%`w3dwV
w(0%cbuS
;H~7OD
LEDhY0
Z<M7y/
'+G+]7:pS?V
9'.{)\
{.:='z~
8>K|~q"
35a7P>
))]q'v
Ru<Mcy
KLCFO,
^UB5UQ
A[^2-4)P
c]$j}?[
Q#:&*z2
_%m,j_
JqV ^3
`C:Xli
H9K`%Do
16^k@IB
kwH1]C
rAB|LQ
* qQ9=F
R8v1yk
znl_sJ/
RpT`Ar
4#S61e#
4~D~/cQ
9|\$`d
u[Zt?%
!DaW\=*
U8dK1(
sO\Eq]
e]Za:i
Ye>1Yg
2mACI8
FwY6TX
DuD.@:
 Dlr9{
\;*Z(K9
Nuf-t[
	y}@T\V
d4n+CSh
1[[aUv
!q8`Im
W7+{(H
,~r1KY
B-[M f-n
DI.KJo
5Su2)g
9=GM\{
Dq_\Y.
 O!Vq%
IzqX]q
Kb|)(@
D:=ovp
nXkuz#
7()a1>
uFiw(N
QGA	Z3
Gz)U<Fz
s-VJz+
\D>@_f:
oLQD%u
)k8b7.Yrp{
d30P4N3/
6.*ZF`
Xj+v:XD
{0Bpku
R,BN@R
aMCrk 
p^YS][
E'tg~k
,;:#S_4c'
|+%f1;
^acGQMr
)Bn.e%,
=TDJ&X
B?:VFE
m_C6[@S
- ~B71g
.8;uKadO
6)N?gQb
,{5/&D
DbgRw1y$I
{7IO-t}
=\.PP\
yV@p]U
}c(_zz-
D,v\y 
(HPNo_?7
7vL]S~
8Ffm25g
,F&|j 
q6@Jqy
i_*3qU
w}w\ZU
$$hj8,
o&	1e?
Onz$"~
[I.pfak
<ekO,^H{
<q'9ZE@$
n R'mD
*NJk@x
=)d'\)'
?~jy@I
El*I7Z
A2	mso"8
Szks=W
cnc:K&C
a][xME
zD$V1D)eS
gt2"yE
G2k'Rg	
WSO:"'
GsS9h]
4N`KKSc
iMpu1I]g
mcoB\wj
v*_Onf
u;(/-o
U%F)%<
_N=exp
R3BrRol
NKS(eF
LqMu`c
Tf'~5A
CkyAF=uVG
O<Qpm{
@)lbiO
=.}6Sl
{9)AA@
``>&P{
B57g_i
5	Wf{L
lPX__ky
w.2Nvm!|
 7uF)qo
2MwQGU
X2O`&A7
&};oi#iN
pK%5`r
8oNSh?
3s?J`'e
G/#tHA
;	Sv3V
m9z<cX
f}C-'*f
+oh^I|#
H+/~&6
k!0n[B
i%Ob06]zF
*wt76o
s,VpLc
(Of5}jg
??Y&=4s
aJ3Q:~
DgqeXXC
+K,<aT
joszK)
O N%A]
3zj`*$p
Zer,{*@XR
u(HJR9
M{u{clhK
O=vL-t
vFieI!1
/|FUu7I
WtR&t8
.Y;hu8
8$Xj/D
t.Apl{v+
g'SwbwK
qAw&'V
G/,qqb
<5%*d 
3g7N?2&/T:
=voO0u
Sx7 A]
B5n0&Z
F%vlUk
@4'GBc
o3'k\HX#-c
.qXJmv
h;ZLsCE
9rl~\fJ
g)ep\[A
q]Ti!i
G`"K>Hu
q>IBHPM
_?G.P~<
.,6ztUj
^zj&t3V
0Q5 =8r).
i*FAl3
?s0C{C
]Mws#DQ_a]8:N
tu$<LDh
i*x}g<
Xk6UDi>
_\4&_:
epR-'IO
fj{oVz
'',`7&
ihv&2T
m3"lh_V
pCGK@j!@
dz%s%1g
.I./QJ
JBHLq7
_o0*5W
MP])t|D
G&K]y?'
A%]LZF
Xv>2m-
F4S)<D
Y!xHu)
RA;AfE
SuAwQZJ
xlrZfm
j bmCk
TbAq,0
~1::?Cg*
S5Dg$W
 Ama."6f
=L!XF2
61ZJvDk{
VV2`/xN
iGVw	oVt
XUW~$ e
~3;9QE
Z.)Xty
]'63^4n
mqb9N-
GW,f(s
c?t(`2I
 jk%`}
bqO\>p
fWReLN
TJc>Fn
56'UIS]
:K7Wsjh
<\oS&:lm
q|*"uMQ
,H'>K ]`
C,><VA
D&.9kb
dKIC%0
L{$"d-n01G[x
wy,'#Mz
.Dy(G'
B}VY(d
%xh6Sf
vDy<0Z
{XK i6
~5"jEZ
[]u0(&
yy,2nM
$wR|tg
[fc,h$^-
o|&=k>v&Gq
lkM_/;
{Z.=g"sW:
}jzR_W
vGV\ol
Cq)sEh
SuTVEH
Z~{6"3
nb>9LC
F?T~<G
uSs!*5
8L78Xs
LH1i?"
qaH^J(V
tQ35Q~
r`Fl@"
J@m!ub
?6z uB
unHViil
uI$n4~I
4/,0C6+
i:`WsV
%kMG*"
5ZF;ORT
E}fVKW
GBV/-z
A|59#{
-mv!+{
<21l0Vr
8BbE9;
S6Ok3Bi
yu4>Q\
^0aV!b
+Bx/L8
'U.UJ[&o
mb4P,S
p"GMAL
~0sNX`
ZU`DoU
,t'-WLC
/oO3|@
>g))tX
#flXtrR
_C"4F	
`:^PMo
?N0k,i
T2<q=8
_1b_UTLZ
bL3yJqp
Dm;@j$
Fd<DaT)
0iaBoa
r4&BYi
;1JbAr&)
Nq:+d!
sqFke2
GT'*F9P
zP&e*?
n9)<&n
B~e;9`
nkzj93
e+m?J7
_p;1O#y,l+b6
u_"R-1
:}LtHjz
|Dy&=l
lO75(ui
YCoLMiq
$$Iz.G{
qT44`Y
\wgU/m
[@}lZG97
F1_ca/
nB@dNcU7a
6	Q]\C,eNhs
Ab&N,U6
~@s7 R
+%cw*hnoe
/^]xnA,
_XQgY)
rL#go%
Xf_I[g
	oofza
\VSKk _
 $Z>TQ
|Wd(2e
X\qT?!d
|:^->q
Ha!MsM
	*Ur=h
i(ME9l
o]y~v0
w5lP=R
MR{o>~
	.T9y"
S0K'4q
V|Y}LbAm
0%	-r\
7oc^/er[:
rCp~,6
~Im5'$
cdH5D5
 w97+a
+^DF)bW
xGMq47
ew~1Fbcrz8C
}O8"'F
>K3k|7*
ebpA*t*
bGtp,}
{yLDus.
RV[T[kiC
Z	ir7R|Sju
eP$l,j+
C|`>;$
hh`*.(Ds
lq<CI9?6
n:6D*@
Fu{^2z
b(	Kqy
lg#<Wp
g9D%O8
SJ@9`z
1a1^8?
{;[V.Z
W7%KPx_]^
ZM6r7r`
g|XvTM
fPHQp[
zW;xBj
d7gUY,g
+PC^!]
4t3P4>
;FG2G2
\]Q8SQ
S/Hy1g7
&d|'~S
qvFp(3
%|1(64
$uI_ix
|_5YTC
R6LY3F
)eh.AD
c>todFz
?4FL?8
G& uOr}
>J;P~N
=<vT%6
1Gz}R.
2?R&8!
Tu*'I|bg
/zUDT<Mjt
+r5?={h
vz9[88
[#;Fo6
gb=y;*
l11Q2r8
';]-!'
k#.@Mex
Af_Y/8E
gP!La3
a|C0-!
=5EJ_Y
`7^V7*
7B#p*w
eK%Xx$
$:=PLR
I3y`d<
Px~pD&Ei
Y--ZpJ
9^i(T!
U.OaE2LA
PLDj?GA
6k_w@v
[Jy+.P
nuwbSf
R09.9Y
qmW-c; 
xrnA#T
_A!!SC
DVErX-
*zIqh;
H	/h:k-w=
D$--v/
$zlO6	
q5F0yl'
oSi\0}
&5eY/R[
=[&0Xw
[W4lgl
,kmF$V
5<HG<Q
fheQTX
h@` Pe
,nHmb\{
%,8=c3
5k/%MoB,
(ki}b|
QEKog]>
eciQh^
CDf91ZhAY@
#6	3jsE
Grrhh/
$+X@s/
"3D%+$
WU'1k62
FA}A	K
E$">U},8?
_jA4U'
XVbFa73bC
W/mV*:
Dvj&\+Sy
[<k"s7P
QZl}p5#
/RTci[T
bX2~t6
m0q2AO\0k
$@Q:Q6
iAXR{5\qyQ
i.;p#G
eF)z7k
AP:\t~)
nLb0ncV
49"dX/
)bW$`<
&(x2]$Jv
#Uv4Qu
ilW~>_
vQ7"F|KM
8N;p_w
B8#dPd
"Uo#fc
Ck5<=u
DG&usG
|lbY[9
KSJH[J
}rj	d0Q1~a
De	IRCjcv
 -Tt8u
~o%w,X
(R3,|B
4uPscs
\Hxt[f!2]
+K8t~a
4s?<j(e5
w]q_)p
 $k=;2&
;[tFx`
G|r^5K
O7^i39
y=RbO'PS
'kIkJoY
9_lo5.
7j	zbrQ
kCUcGr
,XekYh
"B8!\=
TEAf=@4
 90&-f;
]@)itz
%#Lpd|
6gS!CW
cH  xj
xg&(2+
5xI]K7I
udVIEW
`V?9o2f
2[Y-q}
S]$Un+
ZpQ-rX
/k@OSVW
P.$Aja
2O1^YTh
`@!sM>
kYJQ}:
oaYPL@[
GH%Xh	
<]g*Dp
mc,"d'
aML{8l
 myjhN#
)&*cc.
zNiEql4{
,yAG49
Xpomiu
q|*$J=>z
	B b)&`q
shz$2R.
aqNJl\
KR{i,5
|E!dcq56
Jca?av
iuDp93
>Rpq86>
+WM.\u
Df1UuYU
+JY4N/
S--Cbv
}^?}BO
z>I&Sr	n
$0X-4x(
TXFP[tk
	54$nM
_.`Y]j
G4Lr5P
S[m^	*
M7f{[ju
x0O$=F
ERmF}$
B[$uIr
0$f.>a`
|SC1Qb
8#*4aC
U(";),
zGUzap
f}S&1%}L
fiM{=;
zKpovAw
WX_v!(s
")i5Eg
OL6{8j
h0"KQ=
YrTK3M1
XI04kn
3ee'&Puy
gOQZ8]
A.?pX\8<
PJ^"<U
6g#4wM
VB{TBX
0`QX3W&
$;A`v@(Vj
:w}b_H|bz
5"/Mj~
!gG+E=
OTzws9
XC`|E-
<)Z<k+
HfiWz3)
i.C.0g'x
Ul1Z~	
ks}L])
7?v)NZ
\48e}MT
OtRrg&
oKy%.	
?P5(dj
n8/%/uH4s
Ta]Dwj
=zw'Sc/
BW>C-o
+%4{o;j
Fhdme_%
^L7eB7
'Jt[iKu
2i#	(/
Z>K<lL
|+5}j'|E<
T3s<_D
b3vu_l
":mPop
06DArp
JZ(\rL
JxXPd9T1
awpp7u<
t\^;;u2
TjmTxYl_
/+]-%3
.v)/[	r
>b[|>,
wj@`Ih
O_H|>:
hYn4.d
cfO4GE
+BQh06
bF_E3u
qasH14
pdM]w'
Htkbjc=
UX 8Js
Lgd*;D
]H:=0'
j6MO`JF
Wi51d!x
Er7d1a
*4[P2Y
i6.N'j'T 
}rU#Yv
~CbV2>
|m.]?B
2oYx_t
*Kfy)B
^yYy:Cvmm!E#
YH)bw5O
uIJpTW=
eO@3,Ab
"?_ebem
15	x`~
U`J'K3 
GH=[36
z-9v[@
"SOjOg
_Z55dc
AeM+qy
T3f@7t
E+v^mE
\](=D}
8DLL!?
`*S]RX
4RRw(C
h#@A:r`&
n-aEih
tTt2wu
RAd`W!q4
ZI:NZ.;9
I/:JH445
tt%{j!
AkfVQ@
^C-9f2
5)an2<oP
-S+?zL
(i}`LdG=QW
iaG;9d
rZ~m],
S'59&;
H7_9N$
ZwcIp%
YCZyQau
Qm{Kn-5
FuN>}6
ufbIZV
cH'(b>
f1>gax
,B)9xv
T+L/u)
_&\.x`
L2c6(lq
')!*Yi5
H{2(9Z
0bg%Q.
QNLs<|d>
}I5_,<
jmAa*lB
{P.Mph
F"d*bJ
bb#`Bvd
AWX`eep
OW#cyE
1,LmtT
BM4MFa
YLpM*~
/;+Ss4
(K091#
60Nb@$
QG_Z-t
^v/.^zf
?X$cZNe[
UL0~ 9
q_g`Z%u
b!L^yC^U
?\D0u_peJ
l)o"i%;
dTHIco
?#Z8za
a|~:kV
v):R5AW
!2M8a"|<
V f?($
@;){m+{
'R|_UI
@u#]suN
4rw~	x[
J6W+?@
0X[_H^Ep
}!l(8$tD"
EAY q3
H*S;}>i5e
sCbFxi
=G6/+b
7Y_G\+
$V#;E@aO
djmxm\
yKs"H~i
qX0X)e
6F	6wEW
3/R0[l
<lcN[e
jsR[U+
F4YTl/w
0?\d{al
a{+9=b.
N<|+<;m
ADuO^A
J|f}ji
y%,cs'
C\$)c:n
e6Yc+k
<QL@Gz
0Er_xn
0Z !,z@
d28,A<
&,5JpM
2>i^C(t
PEXjnS
`(0]jA
?4ks[78
y4kkJ~
dJ Y3uH
63Ng-;
D1E5]R
m.QF0t
*M-0/q
d`VZRB
zi>mzt
[G|2M~
w`v-vN
\}SJxR%
:1-_yI4
_KLkGiNq
ky:>_$
85n*zI'
0m#cN81za
&}M_qN
]|)c	~{
@tQ;`v
$nI2F0
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
CharNextA
advapi32.dll
RegCloseKey
oleaut32.dll
SysFreeString
version.dll
VerQueryValueA
gdi32.dll
SaveDC
ole32.dll
OleDraw
comctl32.dll
ImageList_Add
winspool.drv
OpenPrinterA
shell32.dll
ShellExecuteA
comdlg32.dll
ChooseFontA
winmm.dll
mciSendStringA
shfolder.dll
SHGetFolderPathA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
, u, u
llllllllllllllll
llllllllllllllll
llllllllllllllll
lllllll
lllllll
lllllll
llllllh
lllllll
llllllllllllllll
llllllllllllllll
llllllllllllllll
hllllo
"crh"l
;zl>3D
6kq~fT
scX}+n
X30nD`