PyInit_win32evtlog
Behavioral task
behavioral1
Sample
ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d.dll
Resource
win10v2004-20240412-en
General
-
Target
ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d
-
Size
23KB
-
MD5
6de4d4ee8f5418911e23160b47482903
-
SHA1
507c582fc70739434eece6d43d4520abefad22ef
-
SHA256
ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d
-
SHA512
c3e1d5854d11856bca1a0762e75bb91b5c8392aa23c5fd5763f6f753ecdae09d65cb66176d5cb14fda422b32d903847695f34cf8edca4bf329587166407b1652
-
SSDEEP
384:yaNl1Nga/GylSeKC13eknuwC0FILKGEvFqSbzoI+uVDisSFaNJawcudoD7UYzd6+:yaNXCa/GbeKs/nmWILqFZb8I1234nbc7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d
Files
-
ddaa4c6c013fa6d6c2c532f67d2d1d39bbedf5ac67244cbc2bf5b03855fc080d.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE