a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4

General

Target
a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4
Size 659KB
Sample261009-yaerrsea79
SHA256 a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4
MD5 f7737c280f76eab9682f0c5dcf6426f5
SHA1 1956bea85e6c2605b2e610262b3963522d531d0f
SHA512 ff7e6bba6045b16785ad3287e7de9554895c2540ffc89bc22ebcb76a7a025a3ff4718291f4dbe88c0285deeeded7ab76689fbb3c3a6e15621611d7ce71b60530
SSDEEP 12288:X8tX2aJf3LTwEjx21gfcupc5e6PQBxiqGVspixqlzZsVubmCqhbebyET5yais2Xp:XA2ah5Vv3pc5e64BxKUz6ubqhbPETd8Z
TLSH
T19BE4231DA5D6B188F77A83B01FB3C0053C089188C5D7F9DCFC59F41BAD9BA0A5689E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4

File Explorer

a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4

.dll 659KB

a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4

SHA256 a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4
MD5 f7737c280f76eab9682f0c5dcf6426f5
SHA1 1956bea85e6c2605b2e610262b3963522d531d0f
SHA512 ff7e6bba6045b16785ad3287e7de9554895c2540ffc89bc22ebcb76a7a025a3ff4718291f4dbe88c0285deeeded7ab76689fbb3c3a6e15621611d7ce71b60530
SSDEEP 12288:X8tX2aJf3LTwEjx21gfcupc5e6PQBxiqGVspixqlzZsVubmCqhbebyET5yais2Xp:XA2ah5Vv3pc5e64BxKUz6ubqhbPETd8Z
TLSH
T19BE4231DA5D6B188F77A83B01FB3C0053C089188C5D7F9DCFC59F41BAD9BA0A5689E26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2841808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DavAddConnection DavDeleteConnection DavFlushFile DavGetExtendedError DavGetHTTPFromUNCPath DavGetUNCFromHTTPPath DsAddressToSiteNamesA DsAddressToSiteNamesExA DsAddressToSiteNamesExW DsAddressToSiteNamesW DsDeregisterDnsHostRecordsA DsDeregisterDnsHostRecordsW DsEnumerateDomainTrustsA DsEnumerateDomainTrustsW DsGetDcCloseW DsGetDcNameA DsGetDcNameW DsGetDcNameWithAccountA DsGetDcNameWithAccountW DsGetDcNextA DsGetDcNextW DsGetDcOpenA DsGetDcOpenW DsGetDcSiteCoverageA DsGetDcSiteCoverageW DsGetForestTrustInformationW DsGetSiteNameA DsGetSiteNameW DsMergeForestTrustInformationW DsRoleAbortDownlevelServerUpgrade DsRoleCancel DsRoleDcAsDc DsRoleDcAsReplica DsRoleDemoteDc DsRoleDnsNameToFlatName DsRoleFreeMemory DsRoleGetDatabaseFacts DsRoleGetDcOperationProgress DsRoleGetDcOperationResults DsRoleGetPrimaryDomainInformation DsRoleIfmHandleFree DsRoleServerSaveStateForUpgrade DsRoleUpgradeDownlevelServer DsValidateSubnetNameA DsValidateSubnetNameW GetEip I_BrowserDebugCall I_BrowserDebugTrace I_BrowserQueryEmulatedDomains I_BrowserQueryOtherDomains I_BrowserQueryStatistics I_BrowserResetNetlogonState I_BrowserResetStatistics I_BrowserServerEnum I_BrowserSetNetlogonState I_DsUpdateReadOnlyServerDnsRecords I_NetAccountDeltas I_NetAccountSync I_NetChainSetClientAttributes I_NetChainSetClientAttributes2 I_NetDatabaseDeltas I_NetDatabaseRedo I_NetDatabaseSync I_NetDatabaseSync2 I_NetDfsGetVersion I_NetDfsIsThisADomainName I_NetGetDCList I_NetGetForestTrustInformation I_NetLogonControl I_NetLogonControl2 I_NetLogonGetDomainInfo I_NetLogonSamLogoff I_NetLogonSamLogon I_NetLogonSamLogonEx I_NetLogonSamLogonWithFlags I_NetLogonSendToSam I_NetLogonUasLogoff I_NetLogonUasLogon I_NetServerAuthenticate I_NetServerAuthenticate2 I_NetServerAuthenticate3 I_NetServerGetTrustInfo I_NetServerPasswordGet I_NetServerPasswordSet I_NetServerPasswordSet2 I_NetServerReqChallenge I_NetServerSetServiceBits I_NetServerSetServiceBitsEx I_NetServerTrustPasswordsGet I_NetlogonComputeClientDigest I_NetlogonComputeServerDigest JMP NetAccessAdd NetAccessDel NetAccessEnum NetAccessGetInfo NetAccessGetUserPerms NetAccessSetInfo NetAddAlternateComputerName NetAddServiceAccount NetAlertRaise NetAlertRaiseEx NetApiBufferAllocate NetApiBufferFree NetApiBufferReallocate NetApiBufferSize NetAuditClear NetAuditRead NetAuditWrite NetBrowserStatisticsGet NetConfigGet NetConfigGetAll NetConfigSet NetConnectionEnum NetDfsAdd NetDfsAddFtRoot NetDfsAddRootTarget NetDfsAddStdRoot NetDfsAddStdRootForced NetDfsEnum NetDfsGetClientInfo NetDfsGetDcAddress NetDfsGetFtContainerSecurity NetDfsGetInfo NetDfsGetSecurity NetDfsGetStdContainerSecurity NetDfsGetSupportedNamespaceVersion NetDfsManagerGetConfigInfo NetDfsManagerInitialize NetDfsManagerSendSiteInfo NetDfsMove NetDfsRemove NetDfsRemoveFtRoot NetDfsRemoveFtRootForced NetDfsRemoveRootTarget NetDfsRemoveStdRoot NetDfsRename NetDfsSetClientInfo NetDfsSetFtContainerSecurity NetDfsSetInfo NetDfsSetSecurity NetDfsSetStdContainerSecurity NetEnumerateComputerNames NetEnumerateServiceAccounts NetEnumerateTrustedDomains NetErrorLogClear NetErrorLogRead NetErrorLogWrite NetFileClose NetFileEnum NetFileGetInfo NetGetAnyDCName NetGetDCName NetGetDisplayInformationIndex NetGetJoinInformation NetGetJoinableOUs NetGroupAdd NetGroupAddUser NetGroupDel NetGroupDelUser NetGroupEnum NetGroupGetInfo NetGroupGetUsers NetGroupSetInfo NetGroupSetUsers NetIsServiceAccount NetJoinDomain NetLocalGroupAdd NetLocalGroupAddMember NetLocalGroupAddMembers NetLocalGroupDel NetLocalGroupDelMember NetLocalGroupDelMembers NetLocalGroupEnum NetLocalGroupGetInfo NetLocalGroupGetMembers NetLocalGroupSetInfo NetLocalGroupSetMembers NetLogonGetTimeServiceParentDomain NetLogonSetServiceBits NetMessageBufferSend NetMessageNameAdd NetMessageNameDel NetMessageNameEnum NetMessageNameGetInfo NetProvisionComputerAccount NetQueryDisplayInformation NetQueryServiceAccount NetRegisterDomainNameChangeNotification NetRemoteComputerSupports NetRemoteTOD NetRemoveAlternateComputerName NetRemoveServiceAccount NetRenameMachineInDomain NetReplExportDirAdd NetReplExportDirDel NetReplExportDirEnum NetReplExportDirGetInfo NetReplExportDirLock NetReplExportDirSetInfo NetReplExportDirUnlock NetReplGetInfo NetReplImportDirAdd NetReplImportDirDel NetReplImportDirEnum NetReplImportDirGetInfo NetReplImportDirLock NetReplImportDirUnlock NetReplSetInfo NetRequestOfflineDomainJoin NetScheduleJobAdd NetScheduleJobDel NetScheduleJobEnum NetScheduleJobGetInfo NetServerAliasAdd NetServerAliasDel NetServerAliasEnum NetServerComputerNameAdd NetServerComputerNameDel NetServerDiskEnum NetServerEnum NetServerEnumEx NetServerGetInfo NetServerSetInfo NetServerTransportAdd NetServerTransportAddEx NetServerTransportDel NetServerTransportEnum NetServiceControl NetServiceEnum NetServiceGetInfo NetServiceInstall NetSessionDel NetSessionEnum NetSessionGetInfo NetSetPrimaryComputerName NetShareAdd NetShareCheck NetShareDel NetShareDelEx NetShareDelSticky NetShareEnum NetShareEnumSticky NetShareGetInfo NetShareSetInfo NetStatisticsGet NetUnjoinDomain NetUnregisterDomainNameChangeNotification NetUseAdd NetUseDel NetUseEnum NetUseGetInfo NetUserAdd NetUserChangePassword NetUserDel NetUserEnum NetUserGetGroups NetUserGetInfo NetUserGetLocalGroups NetUserModalsGet NetUserModalsSet NetUserSetGroups NetUserSetInfo NetValidateName NetValidatePasswordPolicy NetValidatePasswordPolicyFree NetWkstaGetInfo NetWkstaSetInfo NetWkstaTransportAdd NetWkstaTransportDel NetWkstaTransportEnum NetWkstaUserEnum NetWkstaUserGetInfo NetWkstaUserSetInfo NetapipBufferAllocate Netbios NetpAddTlnFtinfoEntry NetpAllocFtinfoEntry NetpAssertFailed NetpCleanFtinfoContext NetpCloseConfigData NetpCopyFtinfoContext NetpDbgPrint NetpGetConfigBool NetpGetConfigDword NetpGetConfigTStrArray NetpGetConfigValue NetpGetFileSecurity NetpHexDump NetpInitFtinfoContext NetpIsRemote NetpIsUncComputerNameValid NetpMergeFtinfo NetpNetBiosReset NetpNetBiosStatusToApiStatus NetpOpenConfigData NetpSetFileSecurity NetpwNameCanonicalize NetpwNameCompare NetpwNameValidate NetpwPathCanonicalize NetpwPathCompare NetpwPathType NlBindingAddServerToCache NlBindingRemoveServerFromCache NlBindingSetAuthInfo RxNetAccessAdd RxNetAccessDel RxNetAccessEnum RxNetAccessGetInfo RxNetAccessGetUserPerms RxNetAccessSetInfo RxNetServerEnum RxNetUserPasswordSet RxRemoteApi ��ս��_��ʧ�� ȡ��ݵ�ַ_�ı� �ͷ��ڴ�_

Sharing

General

Malware Config

Signatures

File Explorer

a5f6e0a00c8979e377952a9570d0e1604ac5dbdddfce11fc9d66afc99889aff4

generic