Behavioral task
behavioral1
Sample
af25412d61b646321ed5d1b3cdb54c0f6916ea33606b404c9ac38163bd454b8c.dll
Resource
win7-20220812-en
General
-
Target
af25412d61b646321ed5d1b3cdb54c0f6916ea33606b404c9ac38163bd454b8c
-
Size
165KB
-
MD5
852b473a492d54ede103238b56a32070
-
SHA1
288f72d8151e387180c26642c03c05a63c9ef715
-
SHA256
af25412d61b646321ed5d1b3cdb54c0f6916ea33606b404c9ac38163bd454b8c
-
SHA512
5bb9a8c24a97d3f0223f63f425b0644548ed8683f17b9d957897652e96c5e5761032e6bf2dcecc5ba0918d8a749bb0c0ac44b7ee66c9c45f0bf74a99970e33d3
-
SSDEEP
3072:w0FSHPZd2i4TX06tEXBgYHu2E4cI52JsQLy33k65qTJPUzdUsTQ4Jf/y3IB:w0FSHx4TfIgYGIwSnkekJMzzTQ4l/y3Y
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
af25412d61b646321ed5d1b3cdb54c0f6916ea33606b404c9ac38163bd454b8c.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ