01dc2aa2d05f8c08aff945bd715036f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01dc2aa2d05f8c08aff945bd715036f5
Size

24KB
MD5

01dc2aa2d05f8c08aff945bd715036f5
SHA1

bca0972d23795241667b55edb13a537558d64566
SHA256

4277462f225b6b096efa53276190f438802d9f8b0c7b162559c7dc0314909500
SHA512

22bcb78425303b8b2ad84cc87234f9bfaa0648da452f0c5803d7148059d562863f03bdcbe524f0e29b406f3d9458894c679e3667d05cadf397e00d69d0bae4e3
SSDEEP

192:OrmmnxSNVGsVFPKw9uBBQ6PRQkbVSoCC2+Ev3gfWTWa:YwNBYw9uBBQARQkZStClEv3q0Wa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01dc2aa2d05f8c08aff945bd715036f5

Files

01dc2aa2d05f8c08aff945bd715036f5
.dll windows:4 windows x86 arch:x86

7f3f0ea68ae9939d18fd917537f0dcc8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
ExitProcess
Sleep
VirtualProtect
CreateThread
IsBadReadPtr
lstrcatA
CloseHandle
GetModuleFileNameA

user32

SetTimer
wsprintfA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA

ws2_32

gethostname

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

msvcrt

_adjust_fdiv
malloc
_initterm
free
strcmp
strrchr
strlen
memset
strcpy
strcat
memcmp
exit

ntdll

_strlwr
_itoa

Exports

Exports

SUNHACK1
SUNHACK3
ServiceRouteEx
StartServiceEx
StopServiceEx
UNHACK6

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ