StartHook
StopHook
wd_ksHook
wd_tzHook
Behavioral task
behavioral1
Sample
6bfbaaa164e815408aa7b1cc4bec0a9f6226f862a4c49f0b92fdb11503488c2d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6bfbaaa164e815408aa7b1cc4bec0a9f6226f862a4c49f0b92fdb11503488c2d.dll
Resource
win10v2004-20220901-en
Target
6bfbaaa164e815408aa7b1cc4bec0a9f6226f862a4c49f0b92fdb11503488c2d
Size
78KB
MD5
6dfa51a4681f2fde758bf94431c331c7
SHA1
9098bf03edb837bd365a46b55726ff6717a0485f
SHA256
6bfbaaa164e815408aa7b1cc4bec0a9f6226f862a4c49f0b92fdb11503488c2d
SHA512
240fa01a9183e0f7804e3f654722716a88084b0fb3a8863ff961f492727835f305d8b99b65936491f24da21276c0b99221be4faff6abf28d1b1929273b82ddf9
SSDEEP
768:lxvOJz1f2N4swrhAdvWN9PfUaa73KrgfPInbQLveCfO7woqtql:lxvOD2N4sshAdOx0KMfxveCmH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
StartHook
StopHook
wd_ksHook
wd_tzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ