Behavioral task
behavioral1
Sample
cc8d888c0ff0cfb183f3d690dc379891d824f847ec0a7a47a2424d8353594805.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cc8d888c0ff0cfb183f3d690dc379891d824f847ec0a7a47a2424d8353594805.dll
Resource
win10v2004-20221111-en
General
-
Target
cc8d888c0ff0cfb183f3d690dc379891d824f847ec0a7a47a2424d8353594805
-
Size
17KB
-
MD5
fe42d44353f466ca5fc62c8b33dd7850
-
SHA1
059eb506501ebf7bd80446d798941b44ac609607
-
SHA256
cc8d888c0ff0cfb183f3d690dc379891d824f847ec0a7a47a2424d8353594805
-
SHA512
37537e85d09cc0d901cefbfd6d40ed0c9efce4cceaff5cf5a0d3903515b55e7f577c3e391dc6ba04592d98f8eafe6b1e822825abbb4f75cc73ae99bdc0290fca
-
SSDEEP
384:gVwJJQxytV3h7r8Hht9AqhFNeyh2/6hDgZC+/8vCYgBzWx5V4:lQxsR7rw/mqhF8/6lgZr/8vxn5V4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
cc8d888c0ff0cfb183f3d690dc379891d824f847ec0a7a47a2424d8353594805.dll windows x86
Code Sign
3a:aa:24:d3:a7:9a:11:59:bd:5f:49:42:5d:b9:47:f4Certificate
IssuerCN=Root AgencyNot Before22-06-2009 06:42Not After31-12-2039 23:59SubjectCN=Microsoft(R) Windows Media Player,O=Microsoft(R) Windows Media PlayerSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
DllRundll
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 716B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ