xlAutoOpen
Behavioral task
behavioral1
Sample
b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b.xll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b.xll
Resource
win10v2004-20230915-en
General
-
Target
b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b
-
Size
542KB
-
MD5
28618b6b41bafaf0e971326324d41ddb
-
SHA1
8ce14ebeef6c01907a2f61223a1acb0067035468
-
SHA256
b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b
-
SHA512
6c6b75ef981e6d264b1c5c77298cb668291f3b2839c6d27ceef86b1e8b378c77f8389c869cca043bb2cea2a083f7a192f96ba88b04a91311f0c55b37e6d09290
-
SSDEEP
12288:goj0NxDVz+5pAHoWYDWJ7aqYY0cI2EV2a1:g1NxxzIOHoZSho2a
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b
Files
-
b86d60680036da8fb73bf68c76468b12c24ed0e5fc89056e486d8f0b88567f2b.xll windows:1 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 541KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE