4ef6ca04ba28f282c0daacafa128ea7d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4ef6ca04ba28f282c0daacafa128ea7d
Size

24KB
MD5

4ef6ca04ba28f282c0daacafa128ea7d
SHA1

600a5d531f3819153e25cf4a3216deaf2f9c346f
SHA256

82da6fec5f135122f62dec40a347f029efc85836f738e562a123622409a18e22
SHA512

85c8188691182b53a82f794b3be8d3fcf9a459eef6794ec55d97ccaa2fa60eba249c257d7266294c62b5c4f8c0291b201e112d118c5a1c909649984c507915ce
SSDEEP

192:KJJ/Hnx5SH0QP+DuBBQ6PRQkjJqsLpTKEHshi/yX+:KJ9HxkUUEuBBQARQkNHLp+1iK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ef6ca04ba28f282c0daacafa128ea7d

Files

4ef6ca04ba28f282c0daacafa128ea7d
.dll windows:4 windows x86 arch:x86

b9ab41f27ce021e7921be299ffd8699f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrcatA
CloseHandle
GetCurrentDirectoryA
GetModuleFileNameA
CreateThread
lstrlenA
VirtualProtect
Sleep
ExitProcess

user32

SetTimer
MapVirtualKeyA
GetKeyboardState
wsprintfA
CallNextHookEx
KillTimer
ToAscii
UnhookWindowsHookEx
SetWindowsHookExA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ws2_32

gethostname

msvcrt

_adjust_fdiv
malloc
_initterm
free
time
srand
rand
memset
memcpy
strrchr
exit
strlen
fwrite
fclose
fopen
strcat
strcpy
strcmp

ntdll

_strlwr
_itoa

Exports

Exports

StartServiceEx
StopServiceEx
_ServiceRouteEx@12

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 734B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ