StartHook
StopHook
qn_ksHook
qn_tzHook
Behavioral task
behavioral1
Sample
05b4f4393794864f70b4b8aac915f138.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05b4f4393794864f70b4b8aac915f138.dll
Resource
win10v2004-20231215-en
Target
05b4f4393794864f70b4b8aac915f138
Size
13KB
MD5
05b4f4393794864f70b4b8aac915f138
SHA1
3c639458bb9478e67a73976a9bf0f99c4385f457
SHA256
62551cc5584132fb338c965eb35fa9cba30f196eb91b5a3072d6939c51a2a87b
SHA512
7c7c13a5cbc7be2342991862e03bb9eb7687013f2078f75010d92aa845f4a462f8f59a316d10731b4d21349f8283e4aad6c438fcbd9a12721cfb63fdf151b069
SSDEEP
192:nr5f08IaQ1/Ik6CD8+P5Xuc7FkD/0gYog/3f/CauYE63ZIosreSMr2in2mVz:lM81lzY9Fy/rYog/vluZ63ZhxL2i2ml
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
05b4f4393794864f70b4b8aac915f138 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook
StopHook
qn_ksHook
qn_tzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ