Behavioral task
behavioral1
Sample
baff1f395545dac75edb8a5d4d7e8cd4.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
baff1f395545dac75edb8a5d4d7e8cd4.dll
Resource
win10v2004-20240226-en
General
-
Target
baff1f395545dac75edb8a5d4d7e8cd4
-
Size
31KB
-
MD5
baff1f395545dac75edb8a5d4d7e8cd4
-
SHA1
368d5bd40de6ae7bad097028fcc2c6746584c1ba
-
SHA256
d00c30fe94bc9bc6af7c44d54739f00a05d86fc9bd49de5aef9867547dba5800
-
SHA512
dea1b93ed7d5d3ec38e4682bfb957f9418a4732fe6e0d6e7d766f84ce5e433986d434fe4c6d408cd7eb647fe454cd2e1b6d27f57e39cf49dd2cbca8a6fec35ae
-
SSDEEP
768:dnGJNBHjgSCON7F4uXqte8f8N733cBvhCsDehoPnbcuyD7UMd5F:dMn1Cw1Xq2NTMb+hoPnouy8MdH
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource baff1f395545dac75edb8a5d4d7e8cd4
Files
-
baff1f395545dac75edb8a5d4d7e8cd4.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE