DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Cidox.dll
Resource
win7-20220812-en
Target
Trojan-Ransom.Win32.Cidox.acfq-e8327509c0a22c9b91f12d7336fe17d85924b478fbc8f0dbb3fe2f7b69f12e8c
Size
45KB
MD5
93b2388b4b0f1ae16b3c2b80aed9aae1
SHA1
acb38b54a7415fc2b473534bfbe18b63bb8e0d6b
SHA256
e8327509c0a22c9b91f12d7336fe17d85924b478fbc8f0dbb3fe2f7b69f12e8c
SHA512
61f2f7b744f5d9d3c01f8820b63f245d85b0e5959967ef30521b5e0e92a344a75e33750f0ca50f16cbf62f2bb9878415b3bf37b12d25b0d8bd93bfcdc658a39d
SSDEEP
768:pH+sItJWsaSyLfU6ivMExRZsmhcKQQ8uxDRx2mV8NlcB6vNIurk:pesItKSIfdExRZsmhclMx2S8NdvNhk
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ