RunDllHostCallBack
Behavioral task
behavioral1
Sample
493ae95699d55fc96453c3e794ac1ac4.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
493ae95699d55fc96453c3e794ac1ac4.dll
Resource
win10v2004-20231215-en
General
-
Target
493ae95699d55fc96453c3e794ac1ac4
-
Size
321KB
-
MD5
493ae95699d55fc96453c3e794ac1ac4
-
SHA1
6841e229d290b6cd42049fb5cfb31d54283a3103
-
SHA256
ec08d5a9435699f1a016baf9e3e864ee4ad3df72381d38021d15c0007ce0c45a
-
SHA512
36bfacdfbef5b476801dd2bbbe0200f52afcbfe5f1780ed77b89a0fc5b16f42c789049fa6a4d28bce7fb501c32aeb2ca6a866e4e095daea150fb55d8d5d5f68c
-
SSDEEP
6144:7TB0GG4M6j6khBpCoX9PQdQDl7oCjJqKy1fCvCVhnKZlnUTkD0MYoS:710GGR6GkTpftQ+Ftjt2KDnUIQoS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 493ae95699d55fc96453c3e794ac1ac4
Files
-
493ae95699d55fc96453c3e794ac1ac4.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 297KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE