KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
Behavioral task
behavioral1
Sample
347717902dea297f16ec6aaef37cc667.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
347717902dea297f16ec6aaef37cc667.dll
Resource
win10v2004-20231215-en
Target
347717902dea297f16ec6aaef37cc667
Size
249KB
MD5
347717902dea297f16ec6aaef37cc667
SHA1
d9f26a2217aac2ca85a3a344d9bbd449509dbc28
SHA256
e97dfedb4e591bdc0f14376d19fbf6b85e3771229f0ec150efbf6b5ceef0c558
SHA512
4f4d74a9b47bb659a325a279b30477c625900f35db8e84dacecf64a71c55ce1e5f9f639fb90d90bf9328846c12e2f4fcadbf2ae6745ef8ea74e5ebfa4a1a587a
SSDEEP
6144:wumM3QtWp4HgQGdVo4+7mz7x65fyHo46mnS:tdQop4HF0o4nUKH8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
347717902dea297f16ec6aaef37cc667 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ