KillOld
SetHook
runform
testform
Behavioral task
behavioral1
Sample
0b6276df59a752400ab2d48d20fc0680.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0b6276df59a752400ab2d48d20fc0680.dll
Resource
win10v2004-20231215-en
Target
0b6276df59a752400ab2d48d20fc0680
Size
77KB
MD5
0b6276df59a752400ab2d48d20fc0680
SHA1
f9e6a5f99801922f77f997d7c74385db93fa1c8d
SHA256
4dcf5907d10c7e693f03c4e0fa9d2896018b3f7e753f84b947ec05a41f5dee66
SHA512
6e48b04ef50095087c1b7856255df806ccf7f58b5a48a18f12e7a8271c2b225ea0624ef13771c8117544fd1accc7ca8d875d13ffd6bd115f026ac42edd3433c7
SSDEEP
1536:cYtePJsHgEdxPddgBU8gW7DuUfUaq21tM3yGSRu2a1Rt9/+2FQ5bysC3Bgu8Qkgd:cGePgDdOXuUdq2kRSw2a1R/tob1CKu8k
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0b6276df59a752400ab2d48d20fc0680 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
KillOld
SetHook
runform
testform
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ