Ext_RunDLL
Ext_RunDLLEx
Monitor
_Ext_RunDLL@16
_Ext_RunDLLEx@16
_Monitor@16
Behavioral task
behavioral1
Sample
c1bdb725d0f0af28a2d77c86b518070152705bbba2c1f5cbfb30e8fcb2e8b067.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c1bdb725d0f0af28a2d77c86b518070152705bbba2c1f5cbfb30e8fcb2e8b067.dll
Resource
win10v2004-20231215-en
Target
c1bdb725d0f0af28a2d77c86b518070152705bbba2c1f5cbfb30e8fcb2e8b067
Size
1.4MB
MD5
453ec8fb6f811fcf18ffdc704745c7c4
SHA1
a95b1e98fe628951c7aeff858bacff9efad949e3
SHA256
c1bdb725d0f0af28a2d77c86b518070152705bbba2c1f5cbfb30e8fcb2e8b067
SHA512
286a7432a98329b4ec7964ff6a2600940b762ab1e54fe068d6d4842b0a36e7cc919dc8c63f4dfdd3a8e800079ecdc270f74ce8830f0fec1a3d03c5478b74781f
SSDEEP
24576:wwK10PBePLQ35j7ktm03kUhZ4yzoalPXgVQ7rlMY1POfnZTE1Y+8vIkZJK+HpCab:dBPwPqjwM0lloYx5MUOfn9EY0kZrCIuQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c1bdb725d0f0af28a2d77c86b518070152705bbba2c1f5cbfb30e8fcb2e8b067 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Ext_RunDLL
Ext_RunDLLEx
Monitor
_Ext_RunDLL@16
_Ext_RunDLLEx@16
_Monitor@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ