run
Behavioral task
behavioral1
Sample
56d44125a24878047af0245d7e094551.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56d44125a24878047af0245d7e094551.dll
Resource
win10v2004-20231215-en
General
-
Target
56d44125a24878047af0245d7e094551
-
Size
166KB
-
MD5
56d44125a24878047af0245d7e094551
-
SHA1
2069a25f29dbf19e50d09cdc8576529d1ed204e3
-
SHA256
3fd0430f14b4bd7ea4b2acdb37df920c5b72b20327b35be417d80a68b272ee38
-
SHA512
6db17c643efd22fc5ec8b2a3f1e783d3e8a2603b3ce85f1f340dea139c1e4cd8b6fbfc7b3d268cb81461f869f41a8a0823559f1ee7695492abd4fd9c5d184e14
-
SSDEEP
3072:JVNpm01EA7SPu2lrYksL5lMsZPovp1964O3K3KxAfSkyRFDwsu2zAAL:JXpm0105g9+sZI1c4UIrfS38sUAL
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56d44125a24878047af0245d7e094551
Files
-
56d44125a24878047af0245d7e094551.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 13.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 164KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE