startHookqq
Behavioral task
behavioral1
Sample
d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174.dll
Resource
win10v2004-20230703-en
General
-
Target
d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174
-
Size
304KB
-
MD5
6a3c7e55cda391f4379dec1e86971bcb
-
SHA1
82f219f31b2b4aa533d4a7cdc99c7632e8ed7d5b
-
SHA256
d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174
-
SHA512
c827432f9c3cc52fd50d369eba47bd5ced86503f6fb414484dcdd98746cd6ec3c8a8e5fc8f87384f5d73c95af326149843f71199465c2864cfa29da639f7d093
-
SSDEEP
6144:duWU6DEe3PK04Th1+oETd2vmzIqCXVV7oK4zig7pXgtMyNvLVxlPWcfX+vCrnE+7:duKoWPK04TcdiH+BpXo579X+vCr9BoS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174
Files
-
d8defc8515821068184763e9f93cf9d348274c3aecb1fd8ef548c044252fd174.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 524KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 301KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE