fd780bdce49644973edde0e2d5839237ec6d9a9d19240c2dcc1b8b4496abcd71 | Triage

Sharing

General

Target

fd780bdce49644973edde0e2d5839237ec6d9a9d19240c2dcc1b8b4496abcd71
Size

35KB
MD5

81e3e0c963ad81e4d6ef7a26f4edc5f9
SHA1

4c6bf11364cfb1bc049d3362e3a3c22c247c8b00
SHA256

fd780bdce49644973edde0e2d5839237ec6d9a9d19240c2dcc1b8b4496abcd71
SHA512

98611ccd75e9fd9d75f7169131b48c07d7a41e6e5ac6a621f51fdadea865b8992a797947972de4eb6039cb48e6ed24e8eea72320513bc0c7c7a2c2f27d647375
SSDEEP

384:5sN6OwfdPtzmllVc6KXP8oU4QZYN6Xf+LdPnJmdEs9E5rsDX2bS7Q2B:5oSltm23XUoU4QYN6XGL7md3YrsA

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

fd780bdce49644973edde0e2d5839237ec6d9a9d19240c2dcc1b8b4496abcd71
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

?GetOS@Utility@@SAKXZ
DUMMY

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ