AutorunThread
DeleteServiceByName
GetCurDoc
InitHook
RandomDw
SaveToFileH
XorByStr
Behavioral task
behavioral1
Sample
55f4a5e2f4d3442c15a0124cf36c1497.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55f4a5e2f4d3442c15a0124cf36c1497.dll
Resource
win10v2004-20231215-en
Target
55f4a5e2f4d3442c15a0124cf36c1497
Size
13KB
MD5
55f4a5e2f4d3442c15a0124cf36c1497
SHA1
dbe7b16bfdcb1dc2f92fc6c286865c61454bcecc
SHA256
114dc7c8894efb1557e306ab1183bc2ed9d4102f852dabe5be01dbe508611e73
SHA512
ea2a796d40e5aae2498f8bfc31909cf4519e41c4ac68b0f497ec27134ba5701b26de5cd414a9159b86d9f9494e72ca1d49000d233a46a82f973cae49e28e8fe4
SSDEEP
192:yEh7YRrBSpwAaaiDyiGpsYBMF/w/z114h29wtn63u2x8q5v2OQvYlbcJexZ:ThcRVwwAaLy2lY14hU/v2Mlbc6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
55f4a5e2f4d3442c15a0124cf36c1497 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
AutorunThread
DeleteServiceByName
GetCurDoc
InitHook
RandomDw
SaveToFileH
XorByStr
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ