Behavioral task
behavioral1
Sample
0209ba1e8ff1440eba8d83cd58167057.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0209ba1e8ff1440eba8d83cd58167057.dll
Resource
win10v2004-20231215-en
General
-
Target
0209ba1e8ff1440eba8d83cd58167057
-
Size
14KB
-
MD5
0209ba1e8ff1440eba8d83cd58167057
-
SHA1
28a91b67c970f8b6ceac7acce3aac652f3389e6c
-
SHA256
53e3384b5565adf3e03d7678c9432364d730a7eb4007183e06f4fa9a46ebeed7
-
SHA512
b6fa19ea5dca14b99a46a2161b45ec4002d9996c95e0a575b6917896d2df091663ba0bd1d24acbd0afa2b457bf71eb8f0caa3d93f3a3b2ea92d99e6aa6a61e96
-
SSDEEP
384:8FcSaljcdd3iGJ/BS6gbT/Z9kULcS9RjbgGoDkLD:galw5BfS7LTPwSnck/
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0209ba1e8ff1440eba8d83cd58167057 unpack001/out.upx
Files
-
0209ba1e8ff1440eba8d83cd58167057.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.data Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ