DeRegisterShell
RegisterShell
Behavioral task
behavioral1
Sample
db741af4bead0c48d409eb82dce3b62b1544eba11f4712cfa5a01a2c6d76b97c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db741af4bead0c48d409eb82dce3b62b1544eba11f4712cfa5a01a2c6d76b97c.dll
Resource
win10v2004-20220812-en
Target
db741af4bead0c48d409eb82dce3b62b1544eba11f4712cfa5a01a2c6d76b97c
Size
15KB
MD5
388cf9126e7b89998fbc394121cbe715
SHA1
a6cce49f2d28da9301da8f8d6b1638915c5867e3
SHA256
db741af4bead0c48d409eb82dce3b62b1544eba11f4712cfa5a01a2c6d76b97c
SHA512
a068cc6ccc85e5ae80f048ec3de212b8dfcfda7f92e9b2a8315a27f11f73cf3a73c61dd77bbdd77df4290cbb175e91fb721ea59b0f320c1b99c97910da80f9b9
SSDEEP
384:+QD6YiSGCjorYXJYPz6gN0P173qTTo1KKOKZNErvn:juYPzkrgHJwTSK9KZ2r
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
DeRegisterShell
RegisterShell
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE