0abe3a4042a1e35259caaca389502187969ccfd25142facf596f78eab570a13aN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0abe3a4042a1e35259caaca389502187969ccfd25142facf596f78eab570a13aN
Size

49KB
MD5

31e63bee34d74f47aec4c874d209f6f0
SHA1

8aa2af680afe121110c7da1c5a129852b52001c9
SHA256

0abe3a4042a1e35259caaca389502187969ccfd25142facf596f78eab570a13a
SHA512

b87ac2b14fc704f666e59a6b0fada8fcca62d1d15e97e7c7ce56dcb31acade220fe426d7233c06cb1347e326164c58dc5d1cb309ba3db184caf8afe6c2c58332
SSDEEP

1536:Ca+vQ0SBw6eRryj4bkEi8uc5r2/pOtvkwutvxAHq7L:Ca0lSeFWQkEi2QpKvBNHu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0abe3a4042a1e35259caaca389502187969ccfd25142facf596f78eab570a13aN

Files

0abe3a4042a1e35259caaca389502187969ccfd25142facf596f78eab570a13aN
.dll windows:4 windows x86 arch:x86

27a07d3be0a1f038c3d988e85a37083f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetCursorPos

gdi32

DeleteDC

advapi32

QueryServiceStatus

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

_strrev

winmm

waveInClose

ws2_32

__WSAFDIsSet

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

wininet

InternetCloseHandle

avicap32

capGetDriverDescriptionA

msvfw32

ICSeqCompressFrame

psapi

GetModuleFileNameExA

Exports

Exports

Eternal
Go
Heart
On
ServiceMain

Sections

.data
Size: 42KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE