template_x86_windows_svc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

template_x86_windows_svc.exe
Size

15KB
MD5

6cfb286e69a567e80ce816a2e88a0cdb
SHA1

1e1528a559ac42a9ee58a0929dabdf1c91ec3963
SHA256

a8be7714ce60d8dba4348591efb4c7e992b39952daffa0d14dcc6327e684b209
SHA512

812bb467580881c3668564a6fc4b63b1c1f480f9b5d57aee92c6cacc9d61033bfad44dc26838ef90243a71e2b15df251f67c67107589be2e8a2c379eb642cf6c
SSDEEP

96:5nYBxbTmBBjkcfrAlhNHc2BywoAJPQYi3K1DntAfdomPdHWsyz7w7b:h+bTQBk4Alh9pBpbtQYQK5YouI1s7b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
template_x86_windows_svc.exe

Files

template_x86_windows_svc.exe
.exe windows:4 windows x86 arch:x86

b093b9b6223af7f9e72d34d8765aa77f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

CloseHandle
CreateProcessA
ExitProcess
GetThreadContext
ResumeThread
SetThreadContext
VirtualAllocEx
WriteProcessMemory

msvcrt

memset

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 48B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE