cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea

General

Target
cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea
Size 42KB
Sample260723-wpxvsatgrc
SHA256 cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea
MD5 c31582da46af2a787508d58d46cd4367
SHA1 abdc502f86bd9c21042560c6e2b967a5ebb7f644
SHA512 53a2652e014a3e9097aa6a2ef1140cdf4142968286390dad492e12e2f69c359e25d10b2d1b0f0167c112d3a8c283274e0be75c95420981394e88fc9e1f63418b
SSDEEP 768:bRINxk/kWYE0BAfSb7nsuBEniRRbheg4rDgnd84Zw7DRHgWRQ+wg:bIxkshBmGnHBEiRphegaKS4ZQH3Jw
TLSH
T1E713E1A53B08999FCEC8B3315274851EDED4044E8BE183996F9F33BA09981705F38DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea
unpack001/out.upx

File Explorer

cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea

.dll 42KB
out.upx

.dll 106KB

cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea

SHA256 cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea
MD5 c31582da46af2a787508d58d46cd4367
SHA1 abdc502f86bd9c21042560c6e2b967a5ebb7f644
SHA512 53a2652e014a3e9097aa6a2ef1140cdf4142968286390dad492e12e2f69c359e25d10b2d1b0f0167c112d3a8c283274e0be75c95420981394e88fc9e1f63418b
SSDEEP 768:bRINxk/kWYE0BAfSb7nsuBEniRRbheg4rDgnd84Zw7DRHgWRQ+wg:bIxkshBmGnHBEiRphegaKS4ZQH3Jw
TLSH
T1E713E1A53B08999FCEC8B3315274851EDED4044E8BE183996F9F33BA09981705F38DD6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

125728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 d9d2f8c58b9cefd1c303105f41d4033fb4d095dfeb662c0c1cf5ba5f5481dd51
MD5 c2ca20eec26a9b13946e56e962e82f9b
SHA1 a8a7fd4d965f802d135959bede5c3ae0649a1322
SHA512 c874df7135d984f87d2aa093d76e3d78554411ba1fd448fc27ec8dab8fd25e85d41811094cca5a11eda0daae3b0ff5174e7e2a15f7937996bfb5d400a6b4293b
SSDEEP 1536:jg5RUMWid+6xeqNorCM73nqiHFYApjRH6UlvyDDCXRkEN7Gl2SkaeRBs:jg5RUpigmeqNWCkl/XfqGKIm
TLSH
T1BFB39ED1F141B6E9DA8400B3A77D32675E1D3AB007AD88E37BC08939697D0D2E67B742
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

cf9b7296b7bb4a34a75992b05afa1a1310a6bb48590d41e134d15abb05352eea

generic

out.upx

generic