9a1fa62068d3b6ef9007181132818e35 | Triage

Sharing

General

Target

9a1fa62068d3b6ef9007181132818e35
Size

24KB
MD5

9a1fa62068d3b6ef9007181132818e35
SHA1

d2575aaeb69deff0d2f22df15f0548a1fa80d56e
SHA256

d700ce264196b9c78a323d402ebdf66e389533e9720c8c78718ef8922154363d
SHA512

38abe36dcd5648f6defba3403a885ecead4b1d9c881ca159acc4ecd071e78b3ab8df45568959cac088d5c1d8cf8595fa4985f0fe14e377519651568e50762a62
SSDEEP

96:Xxp+moEO6+7oin6cBU3P0b7cDCZRvsQnQ6PRQ0bPfJrYil0RTjiaBzKD2aq3n:XTDID0P0cDuBBQ6PRQkXJXlETjNK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a1fa62068d3b6ef9007181132818e35

Files

9a1fa62068d3b6ef9007181132818e35
.dll windows:4 windows x86 arch:x86

c49b5459c95b7e64e714771e18a1b165

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
Sleep
lstrcatA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

SetWindowsHookExA
wsprintfA
SetTimer
KillTimer
CallNextHookEx
UnhookWindowsHookEx

ws2_32

gethostname

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strrchr
memcpy
strcmp
strlen
memset
strcpy

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ