CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5d68313f442cfbae70aff839d7062a3db7041fae1c36c1f85dcdd80a5fe9c214.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5d68313f442cfbae70aff839d7062a3db7041fae1c36c1f85dcdd80a5fe9c214.dll
Resource
win10v2004-20221111-en
Target
5d68313f442cfbae70aff839d7062a3db7041fae1c36c1f85dcdd80a5fe9c214
Size
65KB
MD5
3ee41563a36c295f8c07ebff0559a1e6
SHA1
dc4f88bee079fe6c3c9ea2c3f081e192b407beb8
SHA256
5d68313f442cfbae70aff839d7062a3db7041fae1c36c1f85dcdd80a5fe9c214
SHA512
86945a5bd3852055118d6baf10b83855be0abc17a844ce06e3a4ccb3bfbba8614a669dfecd2360528212e8e095aa10e46124a8c1f10fae9e899ee2bcca26d2e9
SSDEEP
768:n2W5cWMGXUJOEmO5ivtl+zQwKZLlq7LL+7ryb0mNK6o35wM8TDp2xzI3xV5wz5Pw:2ndGXg75UUziq3q7re0me3uZwVFZ+Ksz
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ