CreateTextServices
Static task
static1
Behavioral task
behavioral1
Sample
0d368ec4d83c8d60c8067ca6f4c3f054.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d368ec4d83c8d60c8067ca6f4c3f054.dll
Resource
win10v2004-20231215-en
General
-
Target
0d368ec4d83c8d60c8067ca6f4c3f054
-
Size
13KB
-
MD5
0d368ec4d83c8d60c8067ca6f4c3f054
-
SHA1
eec2515b02d7b58ae1c99f0dcafb556469626ea7
-
SHA256
78918f8f5db588b0dd05fd523e4f76dd315bd2d0a9ec1fc85036f039410a4701
-
SHA512
17df0ddb602a508fec71ec3640a29fdacb5350973196c0139d537f70c80d1a45cedcd10ca17183aee4d366787c73d647e7f230b1486f6ffaec34610cded66210
-
SSDEEP
384:44+O1D6FbgE7D92IHl3SFA58QWm/FqWivW:/1DgbN2ol0AKQNNG
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d368ec4d83c8d60c8067ca6f4c3f054
Files
-
0d368ec4d83c8d60c8067ca6f4c3f054.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE