DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
DownloaderActiveX.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DownloaderActiveX.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
index2.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
index2.html
Resource
win10v2004-20240226-en
Target
d4d1fc5dc28fd4fa12c54b3e7c3d30f2
Size
79KB
MD5
d4d1fc5dc28fd4fa12c54b3e7c3d30f2
SHA1
d6d3b744fb8a0297cfc5996182092ec840d3e19e
SHA256
b2bd92702fe96c6b5eba92e7b96bc9a65c569b6a9d62383f58da31eb94ad6a7a
SHA512
0492ab53938107a5c24a3ce72439abd0e49376048f8951d60472db033f069434dc5aa8e3866520450e11d2c9987ca311190759000833479c6acbf7da0bb9be4e
SSDEEP
1536:IUxWpEVBi7sSmjn6M7a0SXvsA9aHhICEtUOW6RntNxKNnnbc9xND0ak95Z8LO9:IUQOriASmj6M7abXvshHhIC8bnENnbT1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack002/DownloaderActiveX.ocx | acprotect |
resource | yara_rule |
---|---|
static1/unpack002/DownloaderActiveX.ocx | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack002/DownloaderActiveX.ocx |
unpack003/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ