DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
0bffb49691aea537439e416f0d39b2126d2a4f7969c7a95cfe813dcd74737f70.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0bffb49691aea537439e416f0d39b2126d2a4f7969c7a95cfe813dcd74737f70.dll
Resource
win10v2004-20220812-en
Target
0bffb49691aea537439e416f0d39b2126d2a4f7969c7a95cfe813dcd74737f70
Size
238KB
MD5
65454a1d56f7af106c2b1daa2d9a74d0
SHA1
c5d304b71895e12bf1bbd90a2a7f462fdda2d126
SHA256
0bffb49691aea537439e416f0d39b2126d2a4f7969c7a95cfe813dcd74737f70
SHA512
7b4915a510e9188d48b6270ac2ea459263272b7c6e2ac20f65de6cf8a7d8de269fe549311f8127bcab8be0fdc9dc6974833689ea316a9e3c677d7461a65a6e83
SSDEEP
6144:ZYCSA5Hi3smmFqHBX6mIcAQRUIAlnqoVn2dlHpckgVx:ZzSA5Hi8mmVQRnHk2d5WPVx
Detects file using ACProtect software.
Processes:
resource | yara_rule |
---|---|
sample | acprotect |
Processes:
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ