WSPStartup
Behavioral task
behavioral1
Sample
932ba21f0443ede47a3c032e229c0b6a1b089f5c3afd15cf48079c1921982989.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
932ba21f0443ede47a3c032e229c0b6a1b089f5c3afd15cf48079c1921982989.dll
Resource
win10v2004-20221111-en
General
-
Target
932ba21f0443ede47a3c032e229c0b6a1b089f5c3afd15cf48079c1921982989
-
Size
28KB
-
MD5
9b5d182100290681df1fe133c853b442
-
SHA1
73d7fb8801c944969ed11c448bbbaf43366597f9
-
SHA256
932ba21f0443ede47a3c032e229c0b6a1b089f5c3afd15cf48079c1921982989
-
SHA512
36307f1792f8cdac77f629b75ee8e3e6c5ba75b32c3778fed0304eecdc17f675669969a0c67403b991010cc887b94e1584a2e958eec5fce43c27b5819359f658
-
SSDEEP
768:gW0V0vz6zP+Id7IWv8lYL6mMXzfycYCHpW:gWpvz6pIQ/Mj1Hc
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
932ba21f0443ede47a3c032e229c0b6a1b089f5c3afd15cf48079c1921982989.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ