51e3aadfedb7f6e66ef86812a3547f29 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

51e3aadfedb7f6e66ef86812a3547f29
Size

14KB
MD5

51e3aadfedb7f6e66ef86812a3547f29
SHA1

32b60ce3b9a305be5f140ce890b551dac672da2a
SHA256

907a95c2f880c6c31c4e0ba64a143e7c46988b68d7ebaee9dec3bd6ae0814cc6
SHA512

a78ff1e26df0efdf402dede4666dcd83acda787ed7c2640c3cba4f734640ac86490fe7b40b8297ee9f0449044470e65005d0359c244045e98d0065820ee1d48f
SSDEEP

192:qKOu/kWOk2plQMse6UIlozcBB31od/gIzuBBQ6PRQkzTV8l9Te:rOuR9glQ1UiD31a/dzuBBQARQkXV8X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51e3aadfedb7f6e66ef86812a3547f29

Files

51e3aadfedb7f6e66ef86812a3547f29
.dll windows:4 windows x86 arch:x86

765a2379c789606e0c420aa0bc95ee60

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strlen
memcpy
memcmp
RtlZeroMemory

ws2_32

closesocket
gethostname

kernel32

LoadLibraryA
EnterCriticalSection
DeleteCriticalSection
CreateThread
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
WaitForSingleObject
TerminateThread
Sleep
LeaveCriticalSection
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
lstrcatA
ReadFile
VirtualProtectEx
InitializeCriticalSection

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Exports

Exports

ServiceRouteExA
StartServiceEx
StopServiceEx
UnHookAPI

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ