F1122
Behavioral task
behavioral1
Sample
159370c9236d46597f203e73a2fdbb46.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
159370c9236d46597f203e73a2fdbb46.dll
Resource
win10v2004-20231222-en
General
-
Target
159370c9236d46597f203e73a2fdbb46
-
Size
200KB
-
MD5
159370c9236d46597f203e73a2fdbb46
-
SHA1
b67e531cb73a46eba00c27fa8dfc1e32e4a5cfc7
-
SHA256
a9b3ac81d51101827ba279fc7764a57005f74d0805f8050e6ffea186d3ac46a4
-
SHA512
a7aa73779d3f1704e60bf1f55edb8354cbf089cb285c9c4efb64b9fcb52f44b8762b4e373e91448d7fb56ed0d96a26a910849f5ab1632e2a54836f7443ca6732
-
SSDEEP
6144:eIhMbBuzg3R2mdrzx0KUUKMqhOKvFtV+goSW:egMgz0glOKvcgoSW
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 159370c9236d46597f203e73a2fdbb46
Files
-
159370c9236d46597f203e73a2fdbb46.dll windows:9 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 196KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 196KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE