state
state_deinit
state_init
Behavioral task
behavioral1
Sample
download.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
download.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
download.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
download.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
out.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
out.dll
Resource
win10v2004-20230220-en
Target
download.zip
Size
18KB
MD5
6798aac39730ce9e8187d1c374add94c
SHA1
94328611fa3a50eef2318e1ee23e1eb9bfe2c480
SHA256
f24e7915a6cb35e412b4c82dfbff1e7c45bd6ecacab21d4051a95dee08336ea9
SHA512
0b198fb1e4055f11ced9996e67f3af6a1cf0323e021b490edc77a3bc84117a06362eb5d47b9b5c80308c3c1295a6e713428814970bc5af813202cb0fc8ad27f1
SSDEEP
384:AzDXpnnB3IbhPW06cnxG3WwmUwXOSkwr9Cnxi2/ojFLP8iaFy:o7NnlkW0Tnx6tuXb9Qnxi2GFkFy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/download.exe | acprotect |
resource | yara_rule |
---|---|
static1/unpack001/download.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/download.exe |
unpack002/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
state
state_deinit
state_init
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ