ksHookwo
tzHookwo
Behavioral task
behavioral1
Sample
9c1e6ad89517935234131852892b8ce8.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9c1e6ad89517935234131852892b8ce8.dll
Resource
win10v2004-20231215-en
Target
9c1e6ad89517935234131852892b8ce8
Size
14KB
MD5
9c1e6ad89517935234131852892b8ce8
SHA1
78326537012112924c556e96d43239eded2866a1
SHA256
bef2b2499034c40301470e12656953910b802d8586ebd2e3da57a302668f801d
SHA512
2167e109e652c73241d3b63affd1883120b4aea7dfd3cc9948b8b4417a80e2dee012fc8e60d4f77699fbfebe83e4754822e376777e699ba025bc5d764e491876
SSDEEP
384:2nifiaOgUbfLEabWDB3WL6QQ4XiwcUdG5Woomt2BF:2nifiaOgUbTEabUBmesdComk
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
9c1e6ad89517935234131852892b8ce8 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
ksHookwo
tzHookwo
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ