1a9329f96654bece797058d4bcf09ffc | Triage

Sharing

General

Target

1a9329f96654bece797058d4bcf09ffc
Size

24KB
MD5

1a9329f96654bece797058d4bcf09ffc
SHA1

752cee72c92b146ec4089f0e4c3de39ee179a302
SHA256

ceabe5cc6233fbde4f9115c2860628058ae4bf96020f095ec314fcf6214e635e
SHA512

a80473a35b314f32dadfb20ba7d9b31c52c93edca3e9c70455ea348fe23ae2b3801c2c01b8c361e8d5f4773d24b9117e0a8d7ffc5ac0773db511cc61af3f8ed7
SSDEEP

192:jiCeWHkdsmsHmhJuBBQ6PRQkbcb60YwCa03:uC7HQ9FuBBQARQkIbZYK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a9329f96654bece797058d4bcf09ffc

Files

1a9329f96654bece797058d4bcf09ffc
.dll windows:4 windows x86 arch:x86

78ac3a93e2714432ff324262819f0ca2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
CloseHandle
VirtualProtect
GetModuleFileNameA
CreateThread
Sleep
ExitProcess
GetCurrentDirectoryA
lstrlenA

user32

UnhookWindowsHookEx
KillTimer
wsprintfA
CallNextHookEx
SetWindowsHookExA
SetTimer

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

ws2_32

gethostname

msvcrt

memcmp
strcpy
memset
strlen
memcpy
strrchr
strcmp
strcat
_initterm
malloc
_adjust_fdiv
fputs
fread
fclose
free
fopen

ntdll

_strlwr
_itoa

Exports

Exports

StartServiceEx
StopServiceEx
_ServiceRouteEx@12

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 742B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ