ce8147c0841838eff45f59348e342bbc6656d271dcb16554a3e6f96ee06599d4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce8147c0841838eff45f59348e342bbc6656d271dcb16554a3e6f96ee06599d4
Size

172KB
MD5

8c9a65e3e922dbb09ba77f4d36a90702
SHA1

1dc7d0ebb9f7dfcab885f6f7c621a9b3500d944d
SHA256

ce8147c0841838eff45f59348e342bbc6656d271dcb16554a3e6f96ee06599d4
SHA512

599b99a90166cdbcf8628b383fb942bc21763c750aef36f187109ae51a9299cc4bf1a0c821f8bb3d7fe7142714c5aab6328a171d7d5e176f8cccc5fe743bdec0
SSDEEP

3072:4QHlaqdHXhlzQrFH+ACs8RLPSoErbpM433wz9XhzxycC06A7ix:f4qJnkp+ACs8ROo6pMm3wz9Bs1CC

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

ce8147c0841838eff45f59348e342bbc6656d271dcb16554a3e6f96ee06599d4
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

GIldHCC
GpcnZb
sTsoelIRDES
sfwysFviJ
vBkSmO

Sections

UPX0
Size: - Virtual size: 356KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 170KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ