ClearLock
ClearNVMFile
CreateCalEntry
CreatePBEntry
EndGBPMode
EraseCalEntry
ErasePBEntry
GetNVMFileSize
InitGBPMode
ReadCalDirectory
ReadCalEntry
ReadNVMFile
ReadPBDirectory
ReadPBEntry
WriteCalEntry
WriteNVMFile
WritePBEntry
Behavioral task
behavioral1
Sample
USREX.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
USREX.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
gbp.dll
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
gbp.dll
Resource
win10v2004-20231025-en
Target
9a112d4066ff3ff242f56e6332d586bf7f1179c649e0f69920adf9562867e892.zip.zip
Size
207KB
MD5
09e2bd51135d9f746a1eff302e8f62b9
SHA1
ec5435f1e1a4553e6098a6b0d31f13144f16486b
SHA256
8d3f1a806f9c1c5f359fb5634541d35a1f7a8c43dc2ca4974c9dd9fd4f9acb2d
SHA512
c5de20719d5b7e2ea4e39dfe0f48ff9a1c1eb78cce4d92dad8660f7e74d10d53bb12ac37604e339b6920456166ff355602ca60e8094e4c9587824ef00a6bc8c4
SSDEEP
6144:PHutmPVXqfh2U6WHisKjKGBsm0lnKb9g8kbbuORo/z1:POSdq4CisKjKGB+WCzfE/p
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack002/gbp.dll | acprotect |
resource | yara_rule |
---|---|
static1/unpack002/USREX.EXE | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack002/USREX.EXE |
unpack002/gbp.dll |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ClearLock
ClearNVMFile
CreateCalEntry
CreatePBEntry
EndGBPMode
EraseCalEntry
ErasePBEntry
GetNVMFileSize
InitGBPMode
ReadCalDirectory
ReadCalEntry
ReadNVMFile
ReadPBDirectory
ReadPBEntry
WriteCalEntry
WriteNVMFile
WritePBEntry
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE