StartWachat
Behavioral task
behavioral1
Sample
ea286d22fcbf290518df6b82d773cc453ac90f1d527020d962cbeb3049d9a13d.dll
Resource
win7-20230712-en
General
-
Target
ea286d22fcbf290518df6b82d773cc453ac90f1d527020d962cbeb3049d9a13d
-
Size
875KB
-
MD5
2d3c13deb0260c687195ce36b15374e9
-
SHA1
074108cc2ef88927f7f409652415a5656fa2ee3d
-
SHA256
ea286d22fcbf290518df6b82d773cc453ac90f1d527020d962cbeb3049d9a13d
-
SHA512
4a73286b4ce7ed7613b663f7d2f8c7f4f377892c46ad35addf08dea9951f54852b56143024d4be0bcece219f4f6676641d9c2455b9903da510ac881c5e912fe6
-
SSDEEP
24576:lmkwrXzpKSLfYqwmrP2hEUgBgb90zFt0z72GkPi:gkwvpK3WahFb90H03V
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea286d22fcbf290518df6b82d773cc453ac90f1d527020d962cbeb3049d9a13d
Files
-
ea286d22fcbf290518df6b82d773cc453ac90f1d527020d962cbeb3049d9a13d.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 948KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 872KB - Virtual size: 872KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ