3fab7374bb2c8f531f1403fb1f207e97 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3fab7374bb2c8f531f1403fb1f207e97
Size

14KB
MD5

3fab7374bb2c8f531f1403fb1f207e97
SHA1

9afc52473b0c5bcc35df2effc6181c14be42b35c
SHA256

3bb7c3af732f48bf53e4b76593d16b39a8a7ad951a9e3b98a901da03b944597a
SHA512

8f85e153f4329a9f19d6fb8a78ca6998bf39146e161fcf7bdbab2d15fc966970764db3b2f3e30ba5dbe9bb9e0901540c60111794935c3ae56ba19004efe32c84
SSDEEP

192:ryJ9c4WBWiQMoL0IBzUra1xkuBBQ6PRQkzTVxlum:C9oBzQuuiuBBQARQkXVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fab7374bb2c8f531f1403fb1f207e97

Files

3fab7374bb2c8f531f1403fb1f207e97
.dll windows:4 windows x86 arch:x86

765a2379c789606e0c420aa0bc95ee60

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strlen
memcpy
memcmp
RtlZeroMemory

ws2_32

closesocket
gethostname

kernel32

LoadLibraryA
EnterCriticalSection
DeleteCriticalSection
CreateThread
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
WaitForSingleObject
TerminateThread
Sleep
LeaveCriticalSection
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
lstrcatA
ReadFile
VirtualProtectEx
InitializeCriticalSection

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Exports

Exports

ServiceRouteExA
StartServiceEx
StopServiceEx
UnHookAPI

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ