Behavioral task
behavioral1
Sample
25636e3b6aa7ba435d1f89bc33a47ca6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25636e3b6aa7ba435d1f89bc33a47ca6.dll
Resource
win10v2004-20231222-en
General
-
Target
25636e3b6aa7ba435d1f89bc33a47ca6
-
Size
277KB
-
MD5
25636e3b6aa7ba435d1f89bc33a47ca6
-
SHA1
c9d5b0927685cd82588eb239f84f5023da8a9513
-
SHA256
2d2de4ec2f4138384d7c8e418fcc9d92f73fee6f80b06152b304ade7473b0db8
-
SHA512
7c8551cb772b4e6827e0330c2a911a07bc487c9d35f00a3cb4d242688098213878bbb7c1887ac2921172f10870578f3c58284964e9908849fb331a523a50cc26
-
SSDEEP
6144:ATNGQJOFWypMTG2sUA/uv1YkD1cfpvhk4CfiMO9crXz0AcwjoSv:cJOR6TG2sl/AhKxvhkHDH8cjoSv
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25636e3b6aa7ba435d1f89bc33a47ca6
Files
-
25636e3b6aa7ba435d1f89bc33a47ca6.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 368KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 273KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE