Behavioral task
behavioral1
Sample
ca8bc24fab3dc9dd43c7dadfd5c7ae4cd9f27055d488c05b011f7f39c6896842.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca8bc24fab3dc9dd43c7dadfd5c7ae4cd9f27055d488c05b011f7f39c6896842.dll
Resource
win10v2004-20220901-en
General
-
Target
ca8bc24fab3dc9dd43c7dadfd5c7ae4cd9f27055d488c05b011f7f39c6896842
-
Size
27KB
-
MD5
6c9f3d01d1c55020f92b748477060242
-
SHA1
439f1e77d25aa66440df9bcbef04254ceb46e9cd
-
SHA256
ca8bc24fab3dc9dd43c7dadfd5c7ae4cd9f27055d488c05b011f7f39c6896842
-
SHA512
51e7faeeb0dc8032bdc9b04f1e238a5c41b02ab8b5ba69ce647e375f9b163be91323b1baa18f2f0127b60afd2cfcdf40d733f2b20220ba52c5025686a47a7c6a
-
SSDEEP
384:0YSrPFGUyAt0OT40Tn43XagUAXoTISJ3lkLusklb3GIqLvqn1RvWqilL6s:0FTFGxAtjT4ZarKWJ3tGIEGwTFR
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
ca8bc24fab3dc9dd43c7dadfd5c7ae4cd9f27055d488c05b011f7f39c6896842.dll regsvr32 windows x86
Code Sign
01Certificate
IssuerCN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d09:ae:0cCertificate
IssuerCN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6dNot Before27/11/2002, 17:21Not After26/11/2004, 17:21SubjectCN=Browser Plugin,OU=Website Viewer,O=Browser Plugin,L=Boston,ST=Lincolnshire,C=UKExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
6a:dd:c2:00:0e:b3:6d:9f:2d:84:f5:f0:3f:51:72:f5:e5:11:79:66Signer
Actual PE Digest6a:dd:c2:00:0e:b3:6d:9f:2d:84:f5:f0:3f:51:72:f5:e5:11:79:66Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Browser Plugin,OU=Website Viewer,O=Browser Plugin,L=Boston,ST=Lincolnshire,C=UK15/09/2022, 14:52 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ