8b70477f30bb62095ec6228cc5c71515 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b70477f30bb62095ec6228cc5c71515
Size

24KB
MD5

8b70477f30bb62095ec6228cc5c71515
SHA1

6df168994abc6d5ecdd3137b39f70bb95587d962
SHA256

612f366cbec598a4a42be9e2a47590e1423bdd54b448993021caa86c3834022d
SHA512

45738fee8e9c1d628c61d39416c35234b4ed942086eccef8b8f51541d0a37f65df5fcb5291ab8a028a1c8e7f2622ce8f8691bd3444520289d2ca07250fde1006
SSDEEP

192:XTOlWkme+XfquzYvSamfXUPjuBBQ6PRQkJbZBj+IVjEV:XTKIevu8vSpsuBBQARQkBjfYV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b70477f30bb62095ec6228cc5c71515

Files

8b70477f30bb62095ec6228cc5c71515
.dll windows:4 windows x86 arch:x86

ff54b84e2c54372ca19ef6910a7afb70

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
GetPrivateProfileStringA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

SetWindowsHookExA
wsprintfA
SetTimer
KillTimer
CallNextHookEx
UnhookWindowsHookEx

ws2_32

gethostname
send

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strrchr
strcmp
fopen
fputs
fread
fclose
memcmp
strlen
memset
strcpy
strcat

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ