af13c88d9aede67178e8486fc20705fea6cc1dd1dfe37d417c9e152961ab60d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af13c88d9aede67178e8486fc20705fea6cc1dd1dfe37d417c9e152961ab60d3
Size

46KB
MD5

aa4f116e459e6644bb53f79ff46b50ca
SHA1

a5090e1f695940b28d4089e964ee2660c75fd55a
SHA256

af13c88d9aede67178e8486fc20705fea6cc1dd1dfe37d417c9e152961ab60d3
SHA512

6720234dd9123862f063e787ccab60b65cf6b6db43b455cb94c9e40e99701b058a5fe1251e5faaa754f54043ef75ebaf0e825f921d5518510bd7b37d7049e036
SSDEEP

768:+dW1IzoTAWMd+C5nqqbn3V109jw/rAq8GaNaLAnbcuyD7UaMI9I:+dW1qoTAWMd+Cbn3Ve9jflnouy8aMIi

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

Files

af13c88d9aede67178e8486fc20705fea6cc1dd1dfe37d417c9e152961ab60d3
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.p1z0l0J
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1QZnLIc
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9gZ293F
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE