8ff70baecd87300607b5417439a36ed9

General

Target

8ff70baecd87300607b5417439a36ed9
Size

15KB
MD5

8ff70baecd87300607b5417439a36ed9
SHA1

5d14017da4a9fd707b1e08202243341578aec9fd
SHA256

fa0cf71895b4caf39a4d0a92856e1fd95aec589b13c3b30e145b3caafe0df5b8
SHA512

ab7916543e790c75555a0fc2d7d2c9d1561b3dfc72b5e7dde9e4c1d8aedd8e2d8e3593ed1f9980a10121526dc736d2c9ed31a02ba1fbcfeb838ef651403c9cdd
SSDEEP

384:0/e41SGd11am1i+ftt1BPb6iKbAYO2iJCFi1Xn:P4rnB1vFlzcO2iJCo1Xn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ff70baecd87300607b5417439a36ed9

Files

8ff70baecd87300607b5417439a36ed9
.dll windows:4 windows x86 arch:x86

9f0781d9c28d9a5ad00c4ff6858ccb47

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ConnectNamedPipe
CreateNamedPipeA
GetCurrentProcess
GetStartupInfoA
GetSystemDirectoryA
Process32Next
OpenProcess
Process32First
CreateToolhelp32Snapshot
Sleep
CreateThread
DisconnectNamedPipe
SetEvent
TerminateThread
WaitForSingleObject
CreateEventA
FreeConsole
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
LoadLibraryA
FreeLibrary
ReadFile
GetTempPathA
CreateFileA
WriteFile
CloseHandle
CreateMutexA
DeleteFileA

advapi32

SetServiceStatus
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA

urlmon

URLDownloadToFileA

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile

msvcrt

wcstombs
_adjust_fdiv
malloc
_initterm
free
strrchr
sprintf
strncmp
_stricmp
strncpy

Exports

Exports

ServiceMain
SvchostPushServiceGlobals
TestCheckStatus
TestRunning

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f0781d9c28d9a5ad00c4ff6858ccb47

Headers

File Characteristics

Imports

kernel32

advapi32

urlmon

wininet

msvcrt

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 720B

.reloc Size: 512B - Virtual size: 532B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 720B

.reloc
Size: 512B - Virtual size: 532B