CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ded8fa80588367a5650420b8942c7da8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ded8fa80588367a5650420b8942c7da8.dll
Resource
win10v2004-20240226-en
Target
ded8fa80588367a5650420b8942c7da8
Size
62KB
MD5
ded8fa80588367a5650420b8942c7da8
SHA1
d510d9b930955dc2244127f16028ad904c40ed22
SHA256
4e5fb842af9be36d13c40e23484136bf76d7413f1b6959956996ef5b0215bee3
SHA512
c17a259d53aee8be9e4ee3b166c10e080a1004c24dbe45e3473313deee4072dc87b493f9a48e2651a3aae8f73a41029e78f0bfe6381ee23a778699e9847a351c
SSDEEP
1536:/srG6zvtTTWk9/pxRDy9VEZdiqKzMMJNh9BSOERF3CMB:/2vzFTTnhR+vEZ4BM49XERFDB
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ded8fa80588367a5650420b8942c7da8 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ