HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
Behavioral task
behavioral1
Sample
8b57cfa2feb34d156e5755d6f21ca69a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8b57cfa2feb34d156e5755d6f21ca69a.dll
Resource
win10v2004-20231222-en
Target
8b57cfa2feb34d156e5755d6f21ca69a
Size
222KB
MD5
8b57cfa2feb34d156e5755d6f21ca69a
SHA1
663881e58f2794ec24b507688fc7f5b6fcc4fec7
SHA256
1028f7e53d45c3979e6f3517e2bd0550afd0a1af1cebd9ccc2a24769f36c6c73
SHA512
894a5487217db15e75e51ebf0bffa0752e6c2531d0721b11b641bd7ae5c846fa118b9887b11a1a63daf6211ceb94d7aa6b11d03727756b689611ddedd7cd7bc9
SSDEEP
3072:zKJwvoYSIBDsfC+pUHwsPCPG6cLEI13YiJKB3mBuW5ATp8gYbg5wMwLuPuchT3F:zTvtKCjQAnrYiW3mnNGwTLuPu0T3Y
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8b57cfa2feb34d156e5755d6f21ca69a |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ