code_UP
Behavioral task
behavioral1
Sample
da436203548133764f4d73e9a1565749e84b95fd57122499f0ea05aaa0942d52.dll
Resource
win7-20231215-en
General
-
Target
da436203548133764f4d73e9a1565749e84b95fd57122499f0ea05aaa0942d52
-
Size
79KB
-
MD5
8db5571049c831dfbfac2ba165323ae0
-
SHA1
a567eac4df15fa177f1aaae3d26e48b2b4c23898
-
SHA256
da436203548133764f4d73e9a1565749e84b95fd57122499f0ea05aaa0942d52
-
SHA512
a179073285db2e86ebc3dfd8613619df0dd0bba753fa957bf2399ea8516e161b88a2119a7613158d2be93df7efa403379c6c706a62210b5253884da15966206d
-
SSDEEP
1536:PPFaeE84p9zZ9wsLcljijzSjCAuVacv0M6LF5nKJ0XRAOWZ+u0KL3kHxYO4Jnouk:lZU97clj2WjCPv0M655nPqOWMuLL3kkY
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da436203548133764f4d73e9a1565749e84b95fd57122499f0ea05aaa0942d52
Files
-
da436203548133764f4d73e9a1565749e84b95fd57122499f0ea05aaa0942d52.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 236KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ