MainService
MainWork
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
0dc4e4a0f0392bb868f9e745e548d079.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dc4e4a0f0392bb868f9e745e548d079.dll
Resource
win10v2004-20231215-en
Target
0dc4e4a0f0392bb868f9e745e548d079
Size
146KB
MD5
0dc4e4a0f0392bb868f9e745e548d079
SHA1
30e755d2423f8355290cf5a53351b6a38649b44b
SHA256
bdd70009c2579021d14b3120fbb41baa10c779e425ad25069a49eaaaf9d7573d
SHA512
8a560102bcf7c974f6060cc603150a5fb3328d886b048813b7f1986fbccb357ab5ca4e9523712587c618a414fe46815e112942e6a6f8f0058b67d1ad3e486f19
SSDEEP
3072:leRgu8FAn4HAmtNeoVmm3xkVIl/CQqf02NMFXN5kYzcjhqV0g:ygrF2i/jVmm3xkVpAb57K8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
0dc4e4a0f0392bb868f9e745e548d079 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
MainService
MainWork
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE