CreatePProc
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
SetVMToolTip
Uninstall
UserLogOff
UserLogOn
Behavioral task
behavioral1
Sample
192f8d5a81558ddc52bda848ea00ab59.dll
Resource
win7-20231215-en
Target
192f8d5a81558ddc52bda848ea00ab59
Size
155KB
MD5
192f8d5a81558ddc52bda848ea00ab59
SHA1
a2c52bb61bf047c07aca2d54028a248ea2f54896
SHA256
2ecdbb56a418b73b0af9eda5f3a86dc1df7c7805c5e22ea10cccb7d8305b1434
SHA512
36674fe3b738949901cd1a1801aba2b4ef1e480996059c405ccb1bef02c2b1a96c1e4e4c8b9498c37cd95488cba5af792e4dcd310f1805f4defde5169245de26
SSDEEP
3072:l4ra+x/UjB1fZ1w5NaE/qvkuQKRgA8gwA4k5eh7NcntOovWFZWMn:WrPcPw51qzQ9MGkG44a8sMn
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
192f8d5a81558ddc52bda848ea00ab59 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreatePProc
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
SetVMToolTip
Uninstall
UserLogOff
UserLogOn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ