1894dbf3035e4d40c0b84137fec0555d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1894dbf3035e4d40c0b84137fec0555d
Size

49KB
MD5

1894dbf3035e4d40c0b84137fec0555d
SHA1

3f9248c1bb9e33a8aeb8368b0f9571995ebba7bb
SHA256

38a49256aa3d6a60eb5c48f2b249be04ba4c4cfa4b52b749f08f19c591e7221c
SHA512

0cba7af8093df49444d1a7b849b9089830c01f630ebe9d28cfec1c3af25da25d211707681c8ab8e33656c488650409337bcdda2c5357b7160667f7ceba7c484c
SSDEEP

1536:FPEgOqv+fYbogIdMvPZKW1A6ErnUd8d/Znouy8:iLgKMJKWvdo/Jout

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1894dbf3035e4d40c0b84137fec0555d

Files

1894dbf3035e4d40c0b84137fec0555d
.dll regsvr32 windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

KMB0
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

KMB1
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE