53cd0a90cd041c9e9ffbdae6e922d56e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

53cd0a90cd041c9e9ffbdae6e922d56e
Size

28KB
MD5

53cd0a90cd041c9e9ffbdae6e922d56e
SHA1

721f1dae5e2e2d6ccb137c6b5e45ca1550369493
SHA256

31df806e069c0f978b5c2234c0d35da915fdf82153f6aadd548be2064f358c04
SHA512

9149759c4fc198e1f1a22cd53cdceedcd47ab3fdbdcab691e5958d9653be63712075758c4a13a5157120a7a65623f90f2a4da1369125246fa79bddd435f1f8b9
SSDEEP

384:e4NrAIXeRIRcBMSmnuBBQARQkup9Ntvn3E5K7:e4OIXec0MSfBBQARQk49Nt/E5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53cd0a90cd041c9e9ffbdae6e922d56e

Files

53cd0a90cd041c9e9ffbdae6e922d56e
.dll windows:4 windows x86 arch:x86

5d0a9ae38fe26edffbc9905c97b90309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

SetWindowsHookExA
wsprintfA
SetTimer
KillTimer
CallNextHookEx
UnhookWindowsHookEx

ws2_32

gethostname
send

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

iphlpapi

GetAdaptersInfo

msvcrt

_adjust_fdiv
malloc
_initterm
free
strrchr
strcmp
fopen
fputs
fread
fclose
memcmp
strlen
memset
strcpy
strcat

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ