9ac51f33ad73160043e2d83dfac12934

General

Target
9ac51f33ad73160043e2d83dfac12934
Size 203KB
Sample240214-e9a33shc3t
SHA256 5fb72509d593265e08bd91963071a2fbb43ff231a95d9b2e3d437c832b294995
MD5 9ac51f33ad73160043e2d83dfac12934
SHA1 bd710d4b884ad3963d89c3038e6c5a00b214b328
SHA512 e11d7e1f14dbf41c686be4d8588a8f7cc71ebab591f640d13adf1c6df41e3f413cc5a5fb4cf3b967404e05fa062ffd57c40509758fa4d7d9d6605192beb3a14b
SSDEEP 3072:Bk2febYn/z0nSqK6AEkm6u3Oz/C9qKih+ZquliPcJK:Bks9z0nSz6AEFNOz6g+ZquMP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
9ac51f33ad73160043e2d83dfac12934
unpack001/out.upx

File Explorer

9ac51f33ad73160043e2d83dfac12934

.dll 203KB
out.upx

.dll 500KB

9ac51f33ad73160043e2d83dfac12934

SHA256 5fb72509d593265e08bd91963071a2fbb43ff231a95d9b2e3d437c832b294995
MD5 9ac51f33ad73160043e2d83dfac12934
SHA1 bd710d4b884ad3963d89c3038e6c5a00b214b328
SHA512 e11d7e1f14dbf41c686be4d8588a8f7cc71ebab591f640d13adf1c6df41e3f413cc5a5fb4cf3b967404e05fa062ffd57c40509758fa4d7d9d6605192beb3a14b
SSDEEP 3072:Bk2febYn/z0nSqK6AEkm6u3Oz/C9qKih+ZquliPcJK:Bks9z0nSz6AEFNOz6g+ZquMP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

557200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 7abee781bc71b742be63bb1a7c62fe6558702c3e3b05e76c7a62d457e0f7214f
MD5 f060dbf3c3ed7ce9498a00e46f3493b0
SHA1 7e4eb5a7a91406b3e9a8934ded9546482e4fdd01
SHA512 c9dd03d5d090c43995584264750e67b230942514b7ea49c09271f5ec4c7cd7ac4a5c81f6ea26af5bf0308a3765e2b5c1f24be22b59c31b3a85419925e9ced88c
SSDEEP 12288:RY+UksWuKIuOBvLxcvIJR2gzLNpt3m+lBE4s:R3U9RBjxcvAR/NpJ3BE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

432660

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

9ac51f33ad73160043e2d83dfac12934

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

9ac51f33ad73160043e2d83dfac12934

generic

out.upx

generic