start
Behavioral task
behavioral1
Sample
f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75.dll
Resource
win10v2004-20240426-en
General
-
Target
f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75
-
Size
456KB
-
MD5
b4585485d1704ab4d62abb9b2c5924bc
-
SHA1
04679eaf9f594650bf3e5a42b372c5b821ff46ef
-
SHA256
f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75
-
SHA512
17c29a06ddc2e305871883bdc0cfeeca571d048c8a33fdefcb5fc2fefcbb16c1284326774b47dd31464a41bb61363616bfe5c77a7674418357ca1d2edb8c4629
-
SSDEEP
12288:yvCm+FWUkaRvyhvonJ/3Ynk00FxJcRDA5G+tI5oS:8do7k4V6k0CYRD+6
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75
Files
-
f477e31be81c702cd04803d9a8f657b01095f0d7db6b56c5bef5bf5bcb9afe75.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 1024KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 449KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE