9a98e2fc5420d78a477508f273ce95de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9a98e2fc5420d78a477508f273ce95de
Size

23KB
MD5

9a98e2fc5420d78a477508f273ce95de
SHA1

8d063578f84eb5d43f22dd843943bed26660578f
SHA256

8d446bfdd4458f2b504a0d2016b31895dc17b4af5cdf2b0a22820e8fd92d0cb0
SHA512

1643abd6b15cf1355c492891b8b3acf961201300eda5ec2008e42239bb08698f5db31ece0ad936955e33ab56f465e005fc32757185ba7441553a76a0c0188427
SSDEEP

384:zhl+ttR+WqjWKF7J2RicacTqxy4SWayWtU:z+TRKvF7oRj9UjWO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a98e2fc5420d78a477508f273ce95de

Files

9a98e2fc5420d78a477508f273ce95de
.dll windows:4 windows x86 arch:x86

846a1ab4bcb8d3d77f0b3ff36f799b70

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
OpenProcess
FreeLibrary
CloseHandle
VirtualAllocEx
Sleep
GetSystemDirectoryA
CreateThread
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
LoadLibraryA
GetCurrentProcess

advapi32

SetServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA

msvcrt

_initterm
malloc
_adjust_fdiv
_stricmp
free

Exports

Exports

ServiceMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 829B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ