AddMsg
CloseFileMapping
CloseFileMapping_readonly
GetPatcherWindowHandle
GetPluginDataMemory
GetRegDword
GetRegString
LoadFileMapping
Reg_Delete_Value
SearchAndReplace
SetRegDword
SetRegString
load_patcher
write_disk_file
Behavioral task
behavioral1
Sample
patcher.dll
Resource
win7-20240729-en
Target
patcher.dll
Size
517KB
MD5
ef0fc001ccc70ff2e170a9be049f9797
SHA1
46523944b4ccf9bc0c8b163b5def72d2ec5ca5a4
SHA256
60390fcc66acfc233584d54d5edf00af208606b60cd403474b811732841cc8b7
SHA512
6ec84968125da9d295783b3a259c3ae2b7ad90b307c6510a71c8c519d3f8c6ea3dd540b8c9489eb3fce4fb78cc8da081114cc7f975f4105ddbbe4802d4c91ffc
SSDEEP
12288:Jx1xgX3Rk2s0rTC+PNsEaNRpi0/LuK2qcwVeXqXyqg9p0ws:JxAHK2o+PdaEsaVgyqE0
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
patcher.dll |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
AddMsg
CloseFileMapping
CloseFileMapping_readonly
GetPatcherWindowHandle
GetPluginDataMemory
GetRegDword
GetRegString
LoadFileMapping
Reg_Delete_Value
SearchAndReplace
SetRegDword
SetRegString
load_patcher
write_disk_file
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ