InstService
LDrv
MakeRootkit
Uninstall
WorkAA
WorkBB
WorkStart
Behavioral task
behavioral1
Sample
38c43fbe7dc151751220c9cceb3aa7d4.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38c43fbe7dc151751220c9cceb3aa7d4.dll
Resource
win10v2004-20231215-en
Target
38c43fbe7dc151751220c9cceb3aa7d4
Size
26KB
MD5
38c43fbe7dc151751220c9cceb3aa7d4
SHA1
decb8716d9fed220850266da9f79b77851a728df
SHA256
6cb35e7a47c00599810519a91fd4e0c7247e06ba2557484290b51e684f0396d8
SHA512
0668cb1b72674d230d60632aa18cb224f892d0438d5c72896abb14ed319f16fe327dbff22165561ab5b43b3ecbe11aa0d9346e9b8ff40efc2d1a368277661c2e
SSDEEP
384:1tHoRemEHxBMe7NXITIL9VPeafQpFsYMKFb0TC7BXHko0lk74Mfjfk4EL3gmIO:1toR8NXD9VKzq0J1XuuEMfjMtL3MO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
38c43fbe7dc151751220c9cceb3aa7d4 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InstService
LDrv
MakeRootkit
Uninstall
WorkAA
WorkBB
WorkStart
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ