a5868e3921be0ff6b5178521fedba30e25c2c80b1b6bcf7c5538726d1d83445d

General

Target

a5868e3921be0ff6b5178521fedba30e25c2c80b1b6bcf7c5538726d1d83445d
Size

43KB
MD5

8718d0e1b167cbcc4dc18f1ed078edd2
SHA1

06797a3b002847f27c7534ce831845eecd4870ac
SHA256

a5868e3921be0ff6b5178521fedba30e25c2c80b1b6bcf7c5538726d1d83445d
SHA512

80812462e2aa33dc1ab03f6863cb29af037c219a032f20d9394ef36e448e6e625cb9bac6a786b72c1f1969cf0cb9bccb6a4f134db7f2453c9c63d92327b497e1
SSDEEP

768:uzBWD9+o0+abjjzjzcpe3kApAxNk2be7DDvklCjVlFRRlylnT2:1hPPyjGe3kQUNk2+vblFRRl82

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

a5868e3921be0ff6b5178521fedba30e25c2c80b1b6bcf7c5538726d1d83445d
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
NSPStartup
ServiceMain
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
SvchostPushServiceGlobals
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname

Sections

UPX0
Size: - Virtual size: 124KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 39KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 815B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 124KB

UPX1 Size: 38KB - Virtual size: 40KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 71KB - Virtual size: 71KB

DATA Size: 13KB - Virtual size: 12KB

BSS Size: - Virtual size: 39KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 1024B - Virtual size: 815B

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 5KB

UPX0
Size: - Virtual size: 124KB

UPX1
Size: 38KB - Virtual size: 40KB

.rsrc
Size: 4KB - Virtual size: 4KB

CODE
Size: 71KB - Virtual size: 71KB

DATA
Size: 13KB - Virtual size: 12KB

BSS
Size: - Virtual size: 39KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 815B

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 5KB