931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac

General

Target
931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac
Size 15.4MB
Sample260601-paktcaay6x
SHA256 931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac
MD5 e89582cad0bb50600cd0ca4eff8d696a
SHA1 e16075c07462d32401b71614a3be262dddc69972
SHA512 96fa985734ac22b818aaf1806469b4684f3ae752f26e9086591802340a210b1568b7164f7b8e86fd0ecfadd3e4cd69a5defad8b59b5da55224f4098695e47368
SSDEEP 393216:fY5eTei48PDtWxDSer0m3UVCN+Pvnb7SV2KBoU8O0VWhOdlF:wVX8whJAFVCGvHSVf8O0VWhqlF
TLSH
T192F63357E2F72255F6E6C1319369BAA18A3B5C3F05317032EE2BE7C199712E22DC4193
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac
unpack001/out.upx

File Explorer

931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac

.dll 15.4MB
out.upx

.dll 21.7MB

931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac

SHA256 931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac
MD5 e89582cad0bb50600cd0ca4eff8d696a
SHA1 e16075c07462d32401b71614a3be262dddc69972
SHA512 96fa985734ac22b818aaf1806469b4684f3ae752f26e9086591802340a210b1568b7164f7b8e86fd0ecfadd3e4cd69a5defad8b59b5da55224f4098695e47368
SSDEEP 393216:fY5eTei48PDtWxDSer0m3UVCN+Pvnb7SV2KBoU8O0VWhOdlF:wVX8whJAFVCGvHSVf8O0VWhqlF
TLSH
T192F63357E2F72255F6E6C1319369BAA18A3B5C3F05317032EE2BE7C199712E22DC4193
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23198368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=44, id=14, version=7299,

count=16, id=12, version=7291,

count=44, id=19, version=8022,

count=1, id=11, version=8966,

count=84, id=10, version=8966,

count=24, id=19, version=8034,

count=697, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=257, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=110, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=18, version=8444,

count=98, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=31, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=55, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

out.upx

SHA256 4c3ed0a33ea0228ea7413895f9f2f4033c30655629e59062c56ce980b9619523
MD5 20e8abe23daf15d31c687bf415249026
SHA1 7243723aed9798228bd669bc803ed7b7ffa40ce6
SHA512 67369eab19a9d294a7e4d46fe9b7721c30c509151170a097a5076b465f7e4e3090db9b048ad915fccd026382736a18b7adfe2e1612ac79769b3461929f72fec7
SSDEEP 393216:CM8NykXwypjE0s4ojTNh7hjbf91RPZJF:C3Xw8X+jTPlbzRPZ
TLSH
T1EC37087712F44016F0E847B4E07E1D255A31BEB62838CA4DA2CD954C24F779962EB3EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3758122

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=44, id=14, version=7299,

count=16, id=12, version=7291,

count=44, id=19, version=8022,

count=1, id=11, version=8966,

count=84, id=10, version=8966,

count=24, id=19, version=8034,

count=697, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=257, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=110, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=18, version=8444,

count=98, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=31, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=55, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

Sharing

General

Malware Config

Signatures

File Explorer

931be33533103b35872fe5528703c7ad684b2a2825dc62029e77d4f0b6b05eac

generic

out.upx

generic