Behavioral task
behavioral1
Sample
4cd723deda0c49eabfad2fb106309321072c9a3e2c2a9d6f1e55bf4e71e4d791.dll
Resource
win7-20220812-en
General
-
Target
4cd723deda0c49eabfad2fb106309321072c9a3e2c2a9d6f1e55bf4e71e4d791
-
Size
165KB
-
MD5
0b52420523c387a62063c17b75d2e77c
-
SHA1
cfb0fdbb1e68a7206f92c1c9a953d27fe493c40c
-
SHA256
4cd723deda0c49eabfad2fb106309321072c9a3e2c2a9d6f1e55bf4e71e4d791
-
SHA512
c8498b332833eec37d9dcfb602fcfad57f03dc91394b18394527251134147b9acae8a43a78f637c4bd5bce34bc021f7eee3cff54178dd437bdf136a4a907f5a6
-
SSDEEP
3072:wfcDKhGzQzP/TowOoI4PV/SbETesZArfqrSZW6m0tZezIdDKHClK0T6p3JaG:wfgZ8zPboJUN/UsOrfqL6mGZsIdWHPAu
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
4cd723deda0c49eabfad2fb106309321072c9a3e2c2a9d6f1e55bf4e71e4d791.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ