StartHook
StopHook
dh_ksHook
dh_tzHook
Behavioral task
behavioral1
Sample
18f06c4ac4a90b887bfa5273ef2aaed0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18f06c4ac4a90b887bfa5273ef2aaed0.dll
Resource
win10v2004-20231215-en
Target
18f06c4ac4a90b887bfa5273ef2aaed0
Size
17KB
MD5
18f06c4ac4a90b887bfa5273ef2aaed0
SHA1
77d2fa4fb7aa32291fb7280dd3b10b7f32d780dd
SHA256
71b3205d1878c8a22f79e4381e1873102bb6e58e64d2eed05c783170fbafde93
SHA512
fcd014ddf06787679f266a5f5ac0b1067b78d755b82d734c9cbc90ef5abc7545a899181e2eef194ff97b6d9da827681ba6a5b40290acaec7365f8ebb03192d34
SSDEEP
384:0RGbVU3INtbL9/Q3I4Vm1LMVxjAbCfnjbmbFoCl5Qj:0ReVUat1I38i+b2cA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
18f06c4ac4a90b887bfa5273ef2aaed0 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook
StopHook
dh_ksHook
dh_tzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ