ExchageText
Behavioral task
behavioral1
Sample
8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d.dll
Resource
win10v2004-20230221-en
General
-
Target
8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d
-
Size
616KB
-
MD5
4507e7cdd2ef00ecf46cacde74001808
-
SHA1
f339e93d245d4894929df6c93f88bd9d5a585442
-
SHA256
8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d
-
SHA512
1dc016edaf385fbf8fe3747f7190c69498825bfd3c0ac027cc85e942a80dacc9cf1be5d9e43c363a4ee15bb312064383682be3e26884b38b5ad13e6ba25b8681
-
SSDEEP
12288:OsgWBeVXws+hShaO06ALkDj/6p46NRWpLyycdenfRL8BGDh7nMYRTQ0aHa:Oye2s++rIIDj/SLN8NHpoBGlonZ6
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d unpack001/out.upx
Files
-
8147957f8245f678fa8f88e7032db34668909b707fd858c4f97c5c205270032d.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
UPX0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 607KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1024KB - Virtual size: 1023KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 284KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ