DeRegisterShell
RegisterShell
Behavioral task
behavioral1
Sample
b3641f407ba390bc548cd4231041b51bd223e725db97cb68942403b29cae1b9e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3641f407ba390bc548cd4231041b51bd223e725db97cb68942403b29cae1b9e.dll
Resource
win10v2004-20220812-en
Target
b3641f407ba390bc548cd4231041b51bd223e725db97cb68942403b29cae1b9e
Size
15KB
MD5
a74f8ab273e54a3057612b64ee7eb7b3
SHA1
7fc16b11fbe2636d440a23a83f6609a9531d050d
SHA256
b3641f407ba390bc548cd4231041b51bd223e725db97cb68942403b29cae1b9e
SHA512
0b837d9d76363b709bd24e7a3aac1c797569eb284b35e2589d12656d1b2c39db9a8dfb34afd0674ba7f49f807e773ae4659b93e6972d08bdb77b2b9ac2db491d
SSDEEP
192:smR+paap3nsVLHqc1BYQBWzNQX1u1WEwzA99yVjycjK6qupUWWPuRtgRg8EDj2+N:PRuzOAWwzNzgbzA94VjlxkPmtg+8T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
DeRegisterShell
RegisterShell
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE