e5f3c3053da3707274b8e958a4b498f70f8a92e1beae74da5ea49174e255f898

Sharing

Copy URL Twitter E-mail

General

Target

e5f3c3053da3707274b8e958a4b498f70f8a92e1beae74da5ea49174e255f898
Size

36KB
MD5

0f3db55c90352eab8b3ba15ba30f45e2
SHA1

c31778abe1f0d3b9d1f4b7e0234b5781a10d9c72
SHA256

e5f3c3053da3707274b8e958a4b498f70f8a92e1beae74da5ea49174e255f898
SHA512

e44653495332f684a31020e98950a2ca0da43b937df0ecc7282ddee346ea9cab253440d44436fdff2cd78f1a2958145d49d9531450dc3d587299b25964659e5e
SSDEEP

768:/RuSX0sd3rz7OCReD5RKfS+pVaE86dZR1g:6o7VsP+pVZ1ZR1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5f3c3053da3707274b8e958a4b498f70f8a92e1beae74da5ea49174e255f898

Files

e5f3c3053da3707274b8e958a4b498f70f8a92e1beae74da5ea49174e255f898
.dll windows:4 windows x86 arch:x86

4a2ec5b86253b78c3929b059d13bb7c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
CloseEventLog
ReadEventLogA
GetOldestEventLogRecord
OpenEventLogA

user32

TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
PostQuitMessage
DefWindowProcA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
DispatchMessageA

gdi32

GetStockObject

msvcrt

??3@YAXPAX@Z
localtime
__CxxFrameHandler
fclose
fprintf
fopen
sprintf
_access
fwrite
fgets
fread
ftell
fseek
rand
srand
time
_iob
_purecall
_CxxThrowException
free
malloc
strncmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
atoi
_beginthreadex
??2@YAPAXI@Z
strstr
strncpy
wcstombs
_vsnprintf
strrchr
_strlwr

ws2_32

shutdown
closesocket
connect
gethostbyname
htons
inet_addr
socket
WSAGetLastError
send
recv
WSAStartup
select

iphlpapi

GetAdaptersInfo

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

kernel32

LeaveCriticalSection
GetLastError
SetFilePointer
EnterCriticalSection
GetProcAddress
GlobalAlloc
FreeConsole
Sleep
LoadLibraryA

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a2ec5b86253b78c3929b059d13bb7c5

Headers

File Characteristics

Imports

advapi32

user32

gdi32

msvcrt

ws2_32

iphlpapi

msvcp60

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 2KB