be70609e19996d4d5691a33bb562a2e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be70609e19996d4d5691a33bb562a2e7
Size

28KB
MD5

be70609e19996d4d5691a33bb562a2e7
SHA1

1d8522f59fe53221b7e066bfbb01b39040a49adc
SHA256

0841ee7cd25f51bf5633aefda20d9f6cf887bb14ea61418906189fa256b311c8
SHA512

168ee2c576884cf7c21c4dd4cbdf5ea72f7d37872c7b2047996e85cfde21b40fad1e8b6727b36498f2083f38e622c73a1782f47af59e0cb983028bc4fe6a6f77
SSDEEP

384:6Fw9FPRtJTVUlNi5pjuBBQARQkunxPzrh3E5Kh:68RtJTeupCBBQARQk+xPzNE5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be70609e19996d4d5691a33bb562a2e7

Files

be70609e19996d4d5691a33bb562a2e7
.dll windows:4 windows x86 arch:x86

b038dbb3ac8f66c4a1aa9d53dbdedfa6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

CallNextHookEx
wsprintfA
SetTimer
KillTimer
SetWindowsHookExA
UnhookWindowsHookEx

ws2_32

gethostname
send

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

iphlpapi

GetAdaptersInfo

msvcrt

_adjust_fdiv
malloc
_initterm
free
strrchr
strcmp
fopen
fputs
fread
fclose
memcmp
strlen
memset
strcpy
strcat

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ