d4d1fc5dc28fd4fa12c54b3e7c3d30f2
- SHA256 b2bd92702fe96c6b5eba92e7b96bc9a65c569b6a9d62383f58da31eb94ad6a7a
Behavioral task
behavioral1
Sample
DownloaderActiveX.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
DownloaderActiveX.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
index2.html
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
index2.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target d4d1fc5dc28fd4fa12c54b3e7c3d30f2
- Size 79KB
- Sample240319-bef43adh9v
- SHA256 b2bd92702fe96c6b5eba92e7b96bc9a65c569b6a9d62383f58da31eb94ad6a7a
- MD5 d4d1fc5dc28fd4fa12c54b3e7c3d30f2
- SHA1 d6d3b744fb8a0297cfc5996182092ec840d3e19e
- SHA512 0492ab53938107a5c24a3ce72439abd0e49376048f8951d60472db033f069434dc5aa8e3866520450e11d2c9987ca311190759000833479c6acbf7da0bb9be4e
- SSDEEP 1536:IUxWpEVBi7sSmjn6M7a0SXvsA9aHhICEtUOW6RntNxKNnnbc9xND0ak95Z8LO9:IUQOriASmj6M7abXvshHhIC8bnENnbT1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/DownloaderActiveX.ocx acprotect -
resource yara_rule static1/unpack002/DownloaderActiveX.ocx upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/DownloaderActiveX.ocx unpack003/out.upx
File Explorer
-
d4d1fc5dc28fd4fa12c54b3e7c3d30f2.zip 79KB
-
DownloaderActiveX.cab.cab 80KB
-
DownloaderActiveX.INF274B
-
DownloaderActiveX.ocx.dll 79KB
-
out.upx.dll 228KB
-
index2.html.html .js 1KB
DownloaderActiveX.cab
- SHA256 5e3ac16b7f55ca52a7b4872758f19d09bd4994190b9d114d68cab9f1d9d5b467
- MD5 8fd32442a54c1e5f71345b037f03365a
- SHA1 9f66c66fdd503198424b1dca35541110211c046b
- SHA512 933a1d0ef8d5403e6b9ffab2b093a9c883fc1006980daa718d783ccd41b1c822b7c54b3a021ada83b8feaa55fd79f34dcff93769d32a377b38bba6fc4b46b2e0
- SSDEEP 1536:yUxWpEVBi7sSmjn6M7a0SXvsADaHhICEtUOW6RntNxKNnnb15mMxsj:yUQOriASmj6M7abXvsBHhIC8bnENnb14
- MD5 SHA1 SHA512 SSDEEP
DownloaderActiveX.INF
- SHA256 df1b6db59140e4cc40ee22f97ad8c6d562d49f589f5875855eec8d066a6286c4
- MD5 e75872263fc5341af578332f519548dd
- SHA1 9a28de332515eb852f07dc8896020af700c0e804
- SHA512 704f1db638c63852c481b9783bf5136e6d7d0e1f78ce43ece9abf1908599d4b469dd97933cd99698f93055534d7f470dd9f67de537426fc8ba3244a74a696aff
- MD5 SHA1 SHA512
DownloaderActiveX.ocx
- SHA256 0efa625aa3e66c7881e114eb4c2c7447080c0e508e3c7bb43d292a442fabe880
- MD5 e2b5926c917182788b6bb8f2cbbfc287
- SHA1 121d15bee70dfb435e14f0b60fc6d97af314df8d
- SHA512 6813d5bab2a134926f722ca9a33b803560e3cc295dd3a9bbecc433a620722263e94fd5bfa33d4c5ea106cd0bc61718e36d95aaae168bd910c8d7261dec6d53b1
- SSDEEP 1536:p8XCGD7ZXtDphiuV6YbXaeWaSNapVnFyDAlZwcyamqMxzxDETucB:sRXxphiuQ4SNaPFOcfHOzKucB
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
254560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
UPX0
Size
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
73KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=9, id=19, version=8022,
count=6, productName=Unmarked objects (old),
count=12, id=19, version=8034,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=4, id=4, version=8047,
count=3, id=4, version=9782,
count=471, id=1, productName=Unmarked objects,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=34, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 4b3a574e51786debd1cdc720db5115d2d7a2d41751d9d2dde5a4a34d762a2835
- MD5 75f014e805bcc3bcf2d93ddf236ebf9f
- SHA1 dd65e93a7dfb6d467d758c97e815ea343dc3a0ce
- SHA512 fe43eb25deabe982b437bf95fa3777f9dae01ace850760ebf96313abd6f2b56819eaf8281b2fb2cede9018e244bf157574683e3d9afed0b9b11ef247a3d81578
- SSDEEP 3072:EZ3t5zzkSu/LoGQPYZBbPUYhxpO+kpOpp0GqSDGIn6bO5AaCn9yQ/TB:Eva0YZBbPUYvFBCGqSD1nw95t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
151147
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
160KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=9, id=19, version=8022,
count=6, productName=Unmarked objects (old),
count=12, id=19, version=8034,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=4, id=4, version=8047,
count=3, id=4, version=9782,
count=471, id=1, productName=Unmarked objects,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=34, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
index2.html
- SHA256 fdb664023f1f4a190518c6b8e240d09b4f2d3b13596819a879721577a5a3ce37
- MD5 c1cb85e06dd5dbe543a471ce0a19d567
- SHA1 09ccaaae29a7adc9213ddf7d90c098a37ba85a54
- SHA512 97292372575815a2e3ec7a3ef4aa92f31cfbfc1c85e7a67fe1ece2e278e261ae976fd52ed8fe7d93d868d075b08da14d1447b4c56a4dd795387ef6c8628b3cbc
- MD5 SHA1 SHA512