5a0c1228a21f77a2c69dc960abe74a68 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a0c1228a21f77a2c69dc960abe74a68
Size

32KB
MD5

5a0c1228a21f77a2c69dc960abe74a68
SHA1

fb7c8a8838e71bfcc10e82a56cbb25631812307c
SHA256

03bc9b7c66fdffab76471585f9b18a2ccd2563d4c4fbd464f7c3ff309e112539
SHA512

d42e41b68cb9f48fa81339b8b8b967db2e935c0f1a47fc51a312f91f4fb43e5cd17ee4bd382a6528b50c44161023670cb079edd5b28dd18ec24533ca70fe2eca
SSDEEP

384:LrMJzGxcYj+etCriuBBQARQketyqM+3E5KIo:/eGxYetCrFBBQARQkvEE5ro

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a0c1228a21f77a2c69dc960abe74a68

Files

5a0c1228a21f77a2c69dc960abe74a68
.dll windows:4 windows x86 arch:x86

0c6bbd401a388ae0004a631538047e6b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

wsprintfA
SetTimer
KillTimer
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx

ws2_32

gethostname
send

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

iphlpapi

GetAdaptersInfo

msvcrt

strcat
strcpy
memset
strlen
memcmp
fclose
fread
fputs
fopen
strcmp
strrchr
free
_initterm
malloc
_adjust_fdiv

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ