?ENccg1@@YAHKKDDPAH@Z
?RueenFather@@YAHKKDDPAH@Z
?dd@@YAHKKDDPAH@Z
?haha@@YAHKKDDPAH@Z
KillOld
SetHook
runform
testform
Behavioral task
behavioral1
Sample
4e9342fdc584d5382c7ffd5e16167652.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e9342fdc584d5382c7ffd5e16167652.dll
Resource
win10v2004-20231222-en
Target
4e9342fdc584d5382c7ffd5e16167652
Size
73KB
MD5
4e9342fdc584d5382c7ffd5e16167652
SHA1
f4eb241c9d1badc9c1414acdb8d4c972bda84a7d
SHA256
28d2dcd61252a0ef3798d6025a584bec817fd027e9557f56e2da9c339f1e118b
SHA512
420c6aaea9964dc96c8c1d91371fc9ca746408a078ed531725560a381dc778ac3ed363d4fed161cf0060c5f1e2dc7b8fec8ce9644665620748d17b208ae37f37
SSDEEP
1536:Fg5v6e0fHY0Q7QwwRzuj4WC02aea9SU+5Scz/+7/VC8tdDvt:FgWNgwNuRAaAHot/VC8zh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4e9342fdc584d5382c7ffd5e16167652 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?ENccg1@@YAHKKDDPAH@Z
?RueenFather@@YAHKKDDPAH@Z
?dd@@YAHKKDDPAH@Z
?haha@@YAHKKDDPAH@Z
KillOld
SetHook
runform
testform
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ