409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e

General

Target
409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e
Size 14.7MB
Sample260721-vdedmax1et
SHA256 409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e
MD5 98719a2fad95b6af6bf89a9999f530c4
SHA1 467f953dca5e464e0401ecadd0b874916815074c
SHA512 d21854d9b4b2648b3be94a1392ee4e8f5a0dea5db229e1e4e524b6440793a37dbbdb4b57e8f656569c38d283c54b5705a4a7845f18164c9f40a6ebd33446fb65
SSDEEP 393216:URqEeSBq03yErhT5s9QPKU1bKs3JbNTNR:Nzkq0CEFlmIFKs5bR
TLSH
T1D6F6336B3E536CF1D6EC2236506F638262F4B9642897E720F70AD3DA0DF69E63791044
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e
unpack001/out.upx

File Explorer

409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e

.dll 14.7MB
out.upx

.dll 16.2MB

409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e

SHA256 409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e
MD5 98719a2fad95b6af6bf89a9999f530c4
SHA1 467f953dca5e464e0401ecadd0b874916815074c
SHA512 d21854d9b4b2648b3be94a1392ee4e8f5a0dea5db229e1e4e524b6440793a37dbbdb4b57e8f656569c38d283c54b5705a4a7845f18164c9f40a6ebd33446fb65
SSDEEP 393216:URqEeSBq03yErhT5s9QPKU1bKs3JbNTNR:Nzkq0CEFlmIFKs5bR
TLSH
T1D6F6336B3E536CF1D6EC2236506F638262F4B9642897E720F70AD3DA0DF69E63791044
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18140784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 76fa749ac73ca1965da4ce61f686d3a29958393a527ff61be17172765ccd92c2
MD5 c630fb2651cc30f218726462bd942f1d
SHA1 ffb1d348b5dbfbb140260ea13e769cc2f2bf2910
SHA512 1887621116291e141c003f68dfc26d37666ccff215a7411bc19584d0425143d6cc3fe0c6060f650ee1fc8a072bc9b16a4e6768209bc90d7245adb8bed6437400
SSDEEP 196608:MB456E/mabY3qcd1Ru0Ly3Nj88s9IhcsX66PaAYBMslWRg4XnKhcLrLYMrBx:MC1w/+yy3NjZs9IL6fdM/gtc7pBx
TLSH
T14207029E688B81F6D88108F4972B26EB077396754B9C4CF367C43649A1B1FF2703E895
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1113906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.!V3

Size

14.2MB

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

409c299dc9a498e74ef0326cfe19cefdfabc29e12a25ad3b34877ed77432fd0e

generic

out.upx

generic