ETPlugin
Behavioral task
behavioral1
Sample
111fa4168ee927088d0b1c4c8f9fde556e04a0e4a9413af702dec7fd0fa8baea.dll
Resource
win7-20240221-en
General
-
Target
111fa4168ee927088d0b1c4c8f9fde556e04a0e4a9413af702dec7fd0fa8baea
-
Size
69KB
-
MD5
e104799896732831e1af52a4b68995dd
-
SHA1
e850a3d2c162934492763af35b31a144cc4dd746
-
SHA256
111fa4168ee927088d0b1c4c8f9fde556e04a0e4a9413af702dec7fd0fa8baea
-
SHA512
d58a2b24a25454dd2fad2528b7154c14e17f13aa3c15f5cd762aba0b208f81916f201880b393a66f69e6ad499e7a42b2f66a37a2a9438c37098063c9d6e56fb3
-
SSDEEP
1536:+ZlkUUaFcHN7MqQGxdEvxr336bonouy8:+ZlkUU/V+Gx09qbAout
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 111fa4168ee927088d0b1c4c8f9fde556e04a0e4a9413af702dec7fd0fa8baea
Files
-
111fa4168ee927088d0b1c4c8f9fde556e04a0e4a9413af702dec7fd0fa8baea.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 244KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 66KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SIGN Size: 512B - Virtual size: 16B