Behavioral task
behavioral1
Sample
56da4decf08cb6d65f9c88e75f577823.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56da4decf08cb6d65f9c88e75f577823.dll
Resource
win10v2004-20231215-en
General
-
Target
56da4decf08cb6d65f9c88e75f577823
-
Size
97KB
-
MD5
56da4decf08cb6d65f9c88e75f577823
-
SHA1
0fcd974d2d5cf4e6893177f2da344c6e8501ef59
-
SHA256
50c1117cb5c96cda8bf8e51aa43447fb7a0ed27c1d6297047c84c88706d5e88b
-
SHA512
d846308b3db77a669daf7bc0ea87c3842b30d0ed40d025a8988bc47171b372ec3787238375dc2af559e51058005b4c03254322ca1102d51a4077b39601c5bcb3
-
SSDEEP
1536:EvuIbIUBztpecO0AOxL30vc97BjB+6JSRtq8fjjozRgATPa874GGJcjwwdZPma:EZbIUFtc0+vc97BNfSTFADTPaXGEQZ+a
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56da4decf08cb6d65f9c88e75f577823
Files
-
56da4decf08cb6d65f9c88e75f577823.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 68KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE