??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
Static task
static1
Behavioral task
behavioral1
Sample
0f1dbbb202c0975db38dc888c69806f8.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f1dbbb202c0975db38dc888c69806f8.dll
Resource
win10v2004-20231215-en
Target
0f1dbbb202c0975db38dc888c69806f8
Size
387KB
MD5
0f1dbbb202c0975db38dc888c69806f8
SHA1
98074d214ed61e6da3cb131661f0115291bb41a8
SHA256
eb0409291971cd4283b832dceb5bd9639732456a7a94b889121d64c1364a040f
SHA512
69349716f2614073fdf962839b3c0e392486b8d403a5834e29073bbe1e9fbe0e48ec981a3facfb88b0af1159351a295313230582953be4763da0518a5b469173
SSDEEP
12288:/8ua/pN9Fcnl4ZqDafQN0o7zVj0CT63zrs/8:VaxLuGIN0oviCT6Dw/8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
0f1dbbb202c0975db38dc888c69806f8 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE