StartWachat
Behavioral task
behavioral1
Sample
e7631e1eb20fbbbd82e5dd5a46707b0996bd5711dd36503003c957c29bb6c902.dll
Resource
win7-20230712-en
General
-
Target
e7631e1eb20fbbbd82e5dd5a46707b0996bd5711dd36503003c957c29bb6c902
-
Size
3.7MB
-
MD5
ec04beddf41a1c1da1e50e9531ada396
-
SHA1
13f0a8273c40083497eef511d80763b213454d60
-
SHA256
e7631e1eb20fbbbd82e5dd5a46707b0996bd5711dd36503003c957c29bb6c902
-
SHA512
0187d76ae59c2913c0cbf711fef16a2f28b5e50a549f41d00378909c7520ec7a7854cf9964ac5b940dce1ef3a0f4a99d093221089c28a20741be43487a3e5b9f
-
SSDEEP
98304:osD/UmGukiF2zSoWLhqvB4TDHUFKkRUE5tbL0/TM:osD8ruOzSoEHUPNtP0/TM
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7631e1eb20fbbbd82e5dd5a46707b0996bd5711dd36503003c957c29bb6c902
Files
-
e7631e1eb20fbbbd82e5dd5a46707b0996bd5711dd36503003c957c29bb6c902.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 804KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ