Behavioral task
behavioral1
Sample
4ee8cfd605c5ecd29708cd5c940c67e5.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4ee8cfd605c5ecd29708cd5c940c67e5.dll
Resource
win10v2004-20231215-en
General
-
Target
4ee8cfd605c5ecd29708cd5c940c67e5
-
Size
86KB
-
MD5
4ee8cfd605c5ecd29708cd5c940c67e5
-
SHA1
b1e4ee6527ef632bb9fd3aeeddbc02448c775ae4
-
SHA256
00592ed534faede240d5184b30958a580e509bc679db530d544af0a8a86b4536
-
SHA512
0aa946f235f2dc923a40a731166961045e319c79051df2ce31dea611045171441e2a5ddb9690bf742b89df5b351becc2a8212164f68b915e9f16263d656e6042
-
SSDEEP
1536:haCPdp30kpyH8OTfYYJw5cBo2zcrgidkF+8kwDIoujAqttQIlQxMq:hfvk088mftaYoucUidr8nDBuj3ttt4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ee8cfd605c5ecd29708cd5c940c67e5
Files
-
4ee8cfd605c5ecd29708cd5c940c67e5.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 51KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE