Static task
static1
Behavioral task
behavioral1
Sample
0e0cb4237695952390635d644174c888.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0e0cb4237695952390635d644174c888.dll
Resource
win10v2004-20231222-en
General
-
Target
0e0cb4237695952390635d644174c888
-
Size
97KB
-
MD5
0e0cb4237695952390635d644174c888
-
SHA1
0220257d1a76a93cb5f2ce5ffeefff9c8bfb81b8
-
SHA256
5464491219d06ebb7fb0e1e331f3944764ea6e8a7f7014b1d60cb70804341851
-
SHA512
b5b15fb0a5b41acb889559d1dd0ff17b12f6b8ba93ba1315119afc6913eedb66ff5020f46bd14edba32515e1d64a5f7fa490000632c99d520361d4bc7019490c
-
SSDEEP
3072:eeszgDU7kI+l0N5hlE53cTIszGwUFMxtz:YB7kIhdWyc6X
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e0cb4237695952390635d644174c888
Files
-
0e0cb4237695952390635d644174c888.dll windows:4 windows x86 arch:x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Sections
.text Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE