6ff38f2af862664656d29dc82cc5fed5ef3d20d1e71c51074436331d5945bcb2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ff38f2af862664656d29dc82cc5fed5ef3d20d1e71c51074436331d5945bcb2
Size

49KB
MD5

b4f2d847095fcfbd31c8ff696e289570
SHA1

585ec01b8524c1f4fd08053f1e34f9ac3efb1441
SHA256

6ff38f2af862664656d29dc82cc5fed5ef3d20d1e71c51074436331d5945bcb2
SHA512

474edf4ce0ce3441de9852e0eca29dd5a07a6b9e2ad561ea28b8b7a0c7ce007f1ddcb6e74a59a9522def368bd770c0621f973e54209593fe022f10a008414bdf
SSDEEP

768:qt6ZL68m9iaUFDvo+CDc4RQJJPJ0V2pY2xyuYZnK/DYKKGbqCJWejbzAntPo:S6E8frm+C4JJnW20uunK/D+CJWeb+ho

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

6ff38f2af862664656d29dc82cc5fed5ef3d20d1e71c51074436331d5945bcb2
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

UPX0
Size: - Virtual size: 236KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll .js windows x86