Behavioral task
behavioral1
Sample
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b.dll
Resource
win10v2004-20220812-en
General
-
Target
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b.zip
-
Size
113KB
-
MD5
c92ea0cf6f4f8847c744d949eaf6c7e8
-
SHA1
39a533f77e81812fc2ca8643f9b1a81e5d97ff2a
-
SHA256
6ffe2f5539ea3d3c86da1b45022dc85f71c18b6cde335098aa77b226c67bb7a5
-
SHA512
bcf9f20632c955536530995c57d770f898dc5ae2ccd17c3b95a3ec80e58c1b23cf77d36d90a2597b78283e34251bc07a8f4e435d3b57e778487747cab7490d92
-
SSDEEP
1536:fqTOPlNMIJnzEAE1WWuNiVEeYK4IRd26v6gcARKvIVX7MINZ/87bgCAA2bcfGyXI:xV+n1REeYKhvjigojuZWaA2bGG//
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b acprotect -
resource yara_rule static1/unpack001/a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b upx
Files
-
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b.zip.zip .ps1
Password: infected
-
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b.dll windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 59KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b_dump7_0x00260000