Behavioral task
behavioral1
Sample
028e4c0ef373469f3836c7f6ea5c8d2bf9e4c1db6bb3b0151b8abd86c1a1dc91.dll
Resource
win7-20220812-en
General
-
Target
028e4c0ef373469f3836c7f6ea5c8d2bf9e4c1db6bb3b0151b8abd86c1a1dc91
-
Size
169KB
-
MD5
a1624d4a4196f6b358af0ac17145f8cd
-
SHA1
93c1c4488c9ccdaeee2329b3643323070abfdf0d
-
SHA256
028e4c0ef373469f3836c7f6ea5c8d2bf9e4c1db6bb3b0151b8abd86c1a1dc91
-
SHA512
3edaeaf34c5df60f4b7c08d52660045b725ebdf7bfbdb6768016e566b93b267c3f72d43eeb7a39e29ecb86bb168a96d2de778b9f15b344dea6801db7f4d2fc52
-
SSDEEP
3072:T14MFqLyRUC+BrYst11dkOxKwucSPWeYejecsiK83YKSbXB4NBt:TPFqLyRUCsYA1EOxKwuNPFaNif3YKYeZ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
028e4c0ef373469f3836c7f6ea5c8d2bf9e4c1db6bb3b0151b8abd86c1a1dc91.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ