59e4b8d2b65f1690139c094ee27182285febda115304c44e8d9e7329e09dc794

General

Target

59e4b8d2b65f1690139c094ee27182285febda115304c44e8d9e7329e09dc794
Size

48KB
MD5

9bf855e5e8480fdb93fd12068699446d
SHA1

18cd249add7cfae87615ca5b32aca8503337a2d6
SHA256

59e4b8d2b65f1690139c094ee27182285febda115304c44e8d9e7329e09dc794
SHA512

94a0948776e9d7b5ada6d906222fba434ad47295355653a513c8906c6d97f232698f50e9d127fce164e612a4213e773017d5ee49d095dae38251b120e24da10e
SSDEEP

192:huXPvVr7v4mTa6r3BNSPbjDk3W1WK/wKMBRgVFN:hqtBN2UWJYI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59e4b8d2b65f1690139c094ee27182285febda115304c44e8d9e7329e09dc794

Files

59e4b8d2b65f1690139c094ee27182285febda115304c44e8d9e7329e09dc794
.dll windows:6 windows x86 arch:x86

5b96ccf1e9dd2a4ee09bb169ac43b304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\test\SpyProject\SpyProject\Release\Dll64.pdb

Imports

iphlpapi

GetAdaptersInfo

ws2_32

send
recv
closesocket
gethostbyname
inet_addr
htons
socket
connect
setsockopt
WSAStartup
inet_ntoa

kernel32

CreateMutexA
LocalAlloc
CreateFileMappingA
MapViewOfFileEx
CloseHandle
UnmapViewOfFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
LocalFree
GetTickCount
Sleep
lstrlenA
GetModuleFileNameA
lstrcpyA
CreateThread
lstrcpynA
GlobalAlloc
GlobalFree
GetSystemInfo
GlobalMemoryStatusEx
GetComputerNameA
GetACP
GetOEMCP
GetCurrentProcessId
GetNativeSystemInfo
GetVersion
GetVersionExA
OpenMutexA

user32

wsprintfA
CharLowerA

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

ServiceMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b96ccf1e9dd2a4ee09bb169ac43b304

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

ws2_32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 268B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 268B