fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131

General

Target
fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131
Size 9.9MB
Sample261027-e3kzpsbt8l
SHA256 fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131
MD5 b217edb8f604fc56c9909f8458bb9458
SHA1 2a6fe9990976d45c9f33c180912d8719e5bf6bb0
SHA512 109f615a9ffc18d26715c62bc8d48d3047b988f368bcee592de23907546faf5fb4f12f146aa176589e17ae11bc211bec218e6348e13e4e45b73661afb27dc58a
SSDEEP 196608:FC13zhuQv4TtXmShcll2mbnp3k81nQoTfV+2/YmDFQ2Z2xZPFiPoR/99+:F0DpKtXJhU681nQoE2rQ5xZtiU/L+
TLSH
T182B6335767189C64D03D8530923BBB508BF1E8624E94B3B32F1ED6E685B1BC1EFD2906
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131
unpack001/out.upx

File Explorer

fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131

.dll 9.9MB
out.upx

.dll 10.7MB

fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131

SHA256 fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131
MD5 b217edb8f604fc56c9909f8458bb9458
SHA1 2a6fe9990976d45c9f33c180912d8719e5bf6bb0
SHA512 109f615a9ffc18d26715c62bc8d48d3047b988f368bcee592de23907546faf5fb4f12f146aa176589e17ae11bc211bec218e6348e13e4e45b73661afb27dc58a
SSDEEP 196608:FC13zhuQv4TtXmShcll2mbnp3k81nQoTfV+2/YmDFQ2Z2xZPFiPoR/99+:F0DpKtXJhU681nQoE2rQ5xZtiU/L+
TLSH
T182B6335767189C64D03D8530923BBB508BF1E8624E94B3B32F1ED6E685B1BC1EFD2906
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12434192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 370e3093566552c6e62b4b253d3ae5bd600ef881c769a87c7f5c373bc07f4db8
MD5 61a335131fd30a9e2dc31baad73d5c3e
SHA1 09b19157ce2a6a705b058222ddf2d5ed4cf45ad3
SHA512 b25f41e669db035df3c55d77aa1bc548056f609db1cfdf97c9a093c4a8a686396c627026045cb9982d4c62371440cbfddf45bcfee7b5b6f559e1d6673d440e57
SSDEEP 196608:mcQUqAvxkh5mlogJO2sYIxjebCX5JEWANjaaVH4Dr:JqWkmloNLxjebCJKlY
TLSH
T126B6025AAACB81F6D8C504F4572B66EB07739A750B584CF367C03609F0B2BF1313A996
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1016930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1]&

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

fbfcd4ac8a8d43ce021e56c5e9feec607f60a6d54a0af8dd1df46de6fbe15131

generic

out.upx

generic