Behavioral task
behavioral1
Sample
4b3eb3653b6f88c5e3d8247990e3cfd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b3eb3653b6f88c5e3d8247990e3cfd2.exe
Resource
win10v2004-20231215-en
General
-
Target
4b3eb3653b6f88c5e3d8247990e3cfd2
-
Size
332KB
-
MD5
4b3eb3653b6f88c5e3d8247990e3cfd2
-
SHA1
ec9b49dc19e9d44b1b786132884ae5f5cce08420
-
SHA256
6b9a9d531f670ebe66e3d13a0fbfa6422386e79ea90c4dbfa6ddf4b413387ffd
-
SHA512
b9b737990642ebc26cddde1ecab5d99b43fccd89dbed534325a3a0502b718249de7ed4126c250ad7e93d480d51c17ef88d8c9ed00451d805e63798fa9c90c05b
-
SSDEEP
6144:WdjVGuOODIAvLd8CyXXF9OlfiE54usk0Q7rcrcSjeVe3Taq+HLTEi:2RLONAvpuVmaeZsWncNx3Tb+XEi
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b3eb3653b6f88c5e3d8247990e3cfd2
Files
-
4b3eb3653b6f88c5e3d8247990e3cfd2.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 208KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 135KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE