StartHook2
StopHook2
Behavioral task
behavioral1
Sample
12994fbaf616d7346381f683e38386a7.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12994fbaf616d7346381f683e38386a7.dll
Resource
win10v2004-20231215-en
Target
12994fbaf616d7346381f683e38386a7
Size
20KB
MD5
12994fbaf616d7346381f683e38386a7
SHA1
dd4ea2bb411a310a7094523c9c9a8cdbd9601ea7
SHA256
d0cd91bb8500cb60fc379e287d410b85e4aa76e407a2432950340ca41e620d52
SHA512
63e220ff2951a44430eaf27d42ac855acb8fe160f68c3d1ed436079cdb924424a7c59595b0cf4c90a15931d44b4ec2bce4f3469734cf0b835c9d404197d2469e
SSDEEP
384:GkAVgeBCgqlgC7tlFbSG2BfxOSwomYQawSpCdhRJq5WuQLM0nw:GkcxAlgC7fFmGcYSu/rSskQN
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
12994fbaf616d7346381f683e38386a7 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook2
StopHook2
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ