Static task
static1
Behavioral task
behavioral1
Sample
CreateAllDataProtectService.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CreateAllDataProtectService.exe
Resource
win10v2004-20230220-en
General
-
Target
CreateAllDataProtectService.exe
-
Size
8KB
-
MD5
393b282797bf5c359155fa298a4bec34
-
SHA1
495299ae33253c448af145c2b80b6555a26bdd78
-
SHA256
7f49983be8300724fe3ba954e09d57c8c843287042a9cc0cd427a01ae8b9706c
-
SHA512
1716521e0befe4f69c1b2789a4cf88390f190124ac3ef760a320c33be9d7689fafaeb9293ea80764ef2cce5a0b64e8a873a36af3f51f3442bf34c620a63bfebf
-
SSDEEP
192:vvkyBmoponyV64h9lDNcqv5Rb2BFaOpYH7Wkf:XJxbjh9lSqxC+Wk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CreateAllDataProtectService.exe
Files
-
CreateAllDataProtectService.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ