4f1faef56dfcae51bb226578c5b1d2e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4f1faef56dfcae51bb226578c5b1d2e0N.exe
Size

80KB
MD5

4f1faef56dfcae51bb226578c5b1d2e0
SHA1

5a985b89e1ea85d239f5475bd9ff237ecf6a0f85
SHA256

a3e95c1d046b2400805ada0e0cdb652246c6e50a76c27b01f4fe1ea0776d10f8
SHA512

049081d0ab4b161b355c37efd385116dac6c1563eee3fadd34079554d5c47e37c97f7db6d3c8cc8276da4fb51236c62ed32b32b66129b58eaa117166944f8318
SSDEEP

1536:oxUd72zaz3bx7e+W1Te//0DXrGJvk3xKMB1nA83F3p2:n72zaz3bs+Wx+/Kr2kBKy1h3Y

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
4f1faef56dfcae51bb226578c5b1d2e0N.exe
unpack001/out.upx

Files

4f1faef56dfcae51bb226578c5b1d2e0N.exe
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

??0?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@IAE@PAVODatabase@@HW4OpenOp@ORecordset@@HH@Z
??0?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@QAE@PAVODatabase@@W4OpenOp@ORecordset@@@Z
??0?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@IAE@PAVODatabase@@HW4OpenOp@ORecordset@@HH@Z
??0?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@QAE@PAVODatabase@@W4OpenOp@ORecordset@@HH@Z
??0?$OListOf@VORadStaffFields@@@@QAE@XZ
??0?$OListOf@VORadStaffPrefsFields@@@@QAE@XZ
??0ODBRadStaffList@@IAE@PAVODatabase@@H@Z
??0ODBRadStaffList@@QAE@PAVODatabase@@@Z
??0OExamNotesApplet@@QAE@XZ
??1?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAE@XZ
??1?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAE@XZ
??1?$OListOf@VORadStaffFields@@@@UAE@XZ
??1?$OListOf@VORadStaffPrefsFields@@@@UAE@XZ
??1ODBAdverseReactions@@UAE@XZ
??1ODBExamTypeProcCode@@UAE@XZ
??1ODBFiltRadStaff@@UAE@XZ
??1ODBPatAdverseReactions@@UAE@XZ
??1ODBPatIns@@UAE@XZ
??1ODBRadStaff@@UAE@XZ
??1ODBRadStaffPrefs@@UAE@XZ
??1ODBScheduledGuarantor@@UAE@XZ
??1ODBScheduledIns@@UAE@XZ
??1ODBScheduledPatientTracking@@UAE@XZ
??1ODBScheduledReasonCode@@UAE@XZ
??1OExamNotesApplet@@UAE@XZ
??_7?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@6B?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@@
??_7?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@6BORadStaffList@@@
??_7?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@6B@
??_7?$OListOf@VORadStaffFields@@@@6B@
??_7?$OListOf@VORadStaffPrefsFields@@@@6B@
??_7ODBRadStaffList@@6B?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@@
??_7ODBRadStaffList@@6BORadStaffList@@@
??_7OExamNotesApplet@@6B@
?AppendSortByFieldNum@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEXHH@Z
?CanRequery@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UBEHXZ
?CanRequery@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UBEHXZ
?CanSortByFieldNum@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UBEHH@Z
?Close@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEXXZ
?DictateDXToggleOnAndOff@OExamNotesApplet@@AAE_NHHAAH@Z
?Dispatch@OExamNotesApplet@@UAE?AW4tRC@@HABVOSelectionList@@AAV3@@Z
?FreeDXRecording@OExamNotesApplet@@AAE_NXZ
?GetFieldAlign@?$OListOf@VORadStaffFields@@@@UBEHH@Z
?GetFieldAlign@?$OListOf@VORadStaffPrefsFields@@@@UBEHH@Z
?GetFieldCharWidth@?$OListOf@VORadStaffFields@@@@UBEHH@Z
?GetFieldCharWidth@?$OListOf@VORadStaffPrefsFields@@@@UBEHH@Z
?GetFieldId@?$OListOf@VORadStaffFields@@@@UBEHH@Z
?GetFieldId@?$OListOf@VORadStaffPrefsFields@@@@UBEHH@Z
?GetFieldIndex@?$OListOf@VORadStaffFields@@@@UBEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFieldIndex@?$OListOf@VORadStaffPrefsFields@@@@UBEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFieldName@?$OListOf@VORadStaffFields@@@@UBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetFieldName@?$OListOf@VORadStaffPrefsFields@@@@UBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetFieldNum@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHJHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetInternalFieldName@?$OListOf@VORadStaffFields@@@@UBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetInternalFieldName@?$OListOf@VORadStaffPrefsFields@@@@UBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetKey@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHJAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetNumFields@?$OListOf@VORadStaffFields@@@@UBEHXZ
?GetNumFields@?$OListOf@VORadStaffPrefsFields@@@@UBEHXZ
?GetNumRecords@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEJPAW4RecordsKnown@OList@@@Z
?GetNumRecords@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEJPAW4RecordsKnown@OList@@@Z
?GetNumRecordsUnfilt@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEJPAW4RecordsKnown@OList@@@Z
?GetNumRecordsUnfilt@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEJPAW4RecordsKnown@OList@@@Z
?GetRecord@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHJAAVORadStaffFields@@@Z
?GetRecord@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEHJAAVORadStaffFields@@@Z
?GetRecset@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@QAEPAVODBRadStaff@@XZ
?GetRuntimeClass@OExamNotesApplet@@UBEPAUCRuntimeClass@@XZ
?GetSortByFieldNum@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHPAH0@Z
?GetThisClass@OExamNotesApplet@@SGPAUCRuntimeClass@@XZ
?HasFilter@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UBEHXZ
?IsLoaded@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@QAEHJ@Z
?IsOpen@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UBEHXZ
?IsOpen@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@QBEHXZ
?LoadRecord@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@QAEHXZ
?MoveToRecord@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHJ@Z
?MoveToRecord@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEHJ@Z
?MustHaveFilter@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHH@Z
?Open@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHXZ
?Open@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEHXZ
?PassFieldsToBeQueried@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEXPBH@Z
?PassFieldsToBeQueried@?$OListOf@VORadStaffFields@@@@UAEXPBH@Z
?PassFieldsToBeQueried@?$OListOf@VORadStaffPrefsFields@@@@UAEXPBH@Z
?RecordingAudiosActive@OExamNotesApplet@@AAE_NAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?Requery@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEHH@Z
?Requery@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEHH@Z
?Run@OExamNotesApplet@@UAE?AW4tRC@@ABVOSelectionList@@@Z
?SetFieldsRecord@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEHJ@Z
?SetFieldsToBeQueried@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEXPBH@Z
?SetForGridDisplay@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEXH@Z
?SetForGridDisplay@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEXH@Z
?SetOpenType@ODBPatAdverseReactions@@UAEXW4OpenOp@ORecordset@@@Z
?SetShouldLimitResultCount@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEXH@Z
?SetShouldLimitResultCount@?$ODBMixin@VORadStaffFields@@VODBRadStaff@@@@UAEXH@Z
?SortByFieldNum@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEXHH@Z
?SuppressDXRecording@OExamNotesApplet@@AAE_NXZ
?Terminate@OExamNotesApplet@@UAE?AW4tRC@@XZ
?_GetBaseClass@OExamNotesApplet@@KGPAUCRuntimeClass@@XZ
?classOExamNotesApplet@OExamNotesApplet@@2UCRuntimeClass@@B
?newGetEntry@?$ODBList@VORadStaffList@@VORadStaffFields@@VODBRadStaff@@@@UAEPAXJ@Z
?newGetRecord@?$OListOf@VORadStaffFields@@@@QAEPAVORadStaffFields@@J@Z
?newGetRecord@?$OListOf@VORadStaffPrefsFields@@@@QAEPAVORadStaffPrefsFields@@J@Z

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 61KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 172KB

UPX1 Size: 61KB - Virtual size: 64KB

.rsrc Size: 12KB - Virtual size: 12KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 13KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 172KB

UPX1
Size: 61KB - Virtual size: 64KB

.rsrc
Size: 12KB - Virtual size: 12KB

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 13KB - Virtual size: 12KB