HookOffRegionProcess
HookOnRegionProcess
zmHookOff
zmHookOn
Behavioral task
behavioral1
Sample
57feff137d2e5b6b7a24329306a58732.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
57feff137d2e5b6b7a24329306a58732.dll
Resource
win10v2004-20231215-en
Target
57feff137d2e5b6b7a24329306a58732
Size
58KB
MD5
57feff137d2e5b6b7a24329306a58732
SHA1
d819cdf226f8bce0104f7b543503f25ba4946d25
SHA256
a78f8e0360f73aba35da0994d8ef8219ae4bb6813a4ba4f5f394d663a02dd7b7
SHA512
e365a258e29999207e07bc22f31d5fdee50ea87bd37fcda431bacf783cff4bf7bf76f2e0e54e9262d59244a96b550912ae327adb286dfa2298e2313001f4c1cb
SSDEEP
768:rDoqCmjc1yu550bjPtyeQtqGGmXJzQtzBogIwYeiz6jtxPKoQg3WDVSycTjkjw:AqCsc1YjAW6FWzYe3xPKofmDVSycTo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
57feff137d2e5b6b7a24329306a58732 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookOffRegionProcess
HookOnRegionProcess
zmHookOff
zmHookOn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ