5fe77d6be52dc63d5ac67974b1a890cb | Triage

Sharing

General

Target

5fe77d6be52dc63d5ac67974b1a890cb
Size

4KB
MD5

5fe77d6be52dc63d5ac67974b1a890cb
SHA1

4374cd7a944d1fd1355766d5f904fe49f246a35f
SHA256

7dfe6d44b9d931764b56362c4cac2bcb21521b64afc4f93bfd7afa56f1e13872
SHA512

667e4bc7f8bbcda73a1683786195bde397f0ca77a8a73fe3efed304fe7c620379735189cb65817b5cb2cc0265cde604d42d5c44607b5335668467a887954ea8d
SSDEEP

48:q7mLuoDpJtYt3RTTOZdsdjV9s0XLXYUXLXvrk7c+hpztU/tW:A6G9RTAdQ9FnDo7ccltU/tW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fe77d6be52dc63d5ac67974b1a890cb

Files

5fe77d6be52dc63d5ac67974b1a890cb
.dll windows:4 windows x86 arch:x86

d4b37f2cbe1ad08f4950db8cc2d74af0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetTempPathA
HeapAlloc
GetProcessHeap
HeapFree
FreeLibrary
GetModuleFileNameA
CreateEventA
CloseHandle
OpenEventA
CreateThread
FreeConsole
LoadLibraryA
Sleep
GetProcAddress

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerW

Exports

Exports

DllCanUnloadNowW
DllRegisterServerW
ServiceMain

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 238B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ