0f14abc3961fa076b302a48664e79707 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f14abc3961fa076b302a48664e79707
Size

42KB
MD5

0f14abc3961fa076b302a48664e79707
SHA1

7dc3f31e26c2b8889ced558341d9c8057d3dc54b
SHA256

bd181c27f353e024f5f0bb5fce61aa2c89adc09ed9045cf8b4f98b774d1741c2
SHA512

40f4cbbe645cd3ec6e4d21ed9490141e6948f9eb18142616d0f43270c98f91561e3008373d7f470e831ebe6047f144baf005fddafee5066308a673748651fc53
SSDEEP

768:mOJXDB7TM++foqfC5nZQjs7HEeJ5YsoWpm5JL4I3QYjdaJdcmCWHEnSBKgVpxWL3:ZJTB7TM++foqfC5nZQjs7HEeJ5HoWpmz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f14abc3961fa076b302a48664e79707

Files

0f14abc3961fa076b302a48664e79707
.dll windows:4 windows x86 arch:x86

7346f2577985ba4c50c1e790405f900d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
FreeLibrary
GetProcAddress

ws2_32

recv
gethostbyname
inet_ntoa
htons
socket
connect
setsockopt
closesocket
send
WSAStartup
inet_addr

msvcrt

_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

Exports

Exports

ServiceMain

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 715B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ