StartHook2
StopHook2
Behavioral task
behavioral1
Sample
013f8cbe35c7162fd78c6e2db16a71f5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
013f8cbe35c7162fd78c6e2db16a71f5.dll
Resource
win10v2004-20231215-en
Target
013f8cbe35c7162fd78c6e2db16a71f5
Size
20KB
MD5
013f8cbe35c7162fd78c6e2db16a71f5
SHA1
e3cf94ed6a3baafedb2e75937ab522bbdddaf9b4
SHA256
a724c0d151bde6a948ad18334347395d9c0e182003a9a13dc48c7e780a352a89
SHA512
2e8f53f683f1cfef281d31ccb0a6e1c06232a88b5bc1275df67c4cdc5ec59e736a62efa80b9e11e92999987d055ee272cbf2439a330a13116362b347019b1f9c
SSDEEP
384:HkAVgeBCgqlgUs6kn/jF3eNcfC2jzQ3ylKMrEVE9co9GJCx:HkcxAlgUo/jFtBXEMrEVE9xcE
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
013f8cbe35c7162fd78c6e2db16a71f5 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook2
StopHook2
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ