?WormMain@@YAXXZ
Static task
static1
Behavioral task
behavioral1
Sample
0a9ffa57d65083c92e0d3d69b00f2f0d.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0a9ffa57d65083c92e0d3d69b00f2f0d.dll
Resource
win10v2004-20231222-en
General
-
Target
0a9ffa57d65083c92e0d3d69b00f2f0d
-
Size
26KB
-
MD5
0a9ffa57d65083c92e0d3d69b00f2f0d
-
SHA1
ec88c8cf7b666e63cd800d869e56510e099b2943
-
SHA256
9bfaf2f0b53f87d1452d4c2aa75027ffb8e66aee1462c3d9eb7a6e55bcac55c8
-
SHA512
fa10ece8826badbbe1f572bfd9f4202b36dc499bca58a9d2e17ceb931b237f69867618fb2e7da732c5598cf24ad31008ebbf459380abbf071b849178eb193ae2
-
SSDEEP
768:ReyHi8DRyr9dQDG2/q2ts9m7LTi7mHnfCNZZ2C6/ix49:YwR1APQTq269mji7mH+4ix49
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a9ffa57d65083c92e0d3d69b00f2f0d
Files
-
0a9ffa57d65083c92e0d3d69b00f2f0d.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
code Size: - Virtual size: 148KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
text Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE