DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MsgHookOff
MsgHookOn
Static task
static1
Behavioral task
behavioral1
Sample
0dd031aaf2c7b32458a837a649cc7ffe.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dd031aaf2c7b32458a837a649cc7ffe.dll
Resource
win10v2004-20231215-en
Target
0dd031aaf2c7b32458a837a649cc7ffe
Size
45KB
MD5
0dd031aaf2c7b32458a837a649cc7ffe
SHA1
65da6bb7ea0a17cbe6f36a62057aec2d67be8558
SHA256
078d73dfe437d48aa54d4fbea8fd2e5d65d26d1b2c025799f4d8cec23e12a21d
SHA512
37ce15ddc592eb6463c8389350b4ac19a5022cbdf976a7f1a92bce862e69af0a6a50b95156b729b1b56d116e25f4d31eacafb75be7eee8684e4c9e4c6fa41f17
SSDEEP
768:6VFxjG3WxB+1v115SBuYg/OxBG/+UCrYOYNHEb:0xKSWv115zCG/+z3Y9Eb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
0dd031aaf2c7b32458a837a649cc7ffe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MsgHookOff
MsgHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE