vshadow[.]exe[.]2

Sharing

Copy URL Twitter E-mail

General

Target

vshadow.exe.2
Size

250KB
MD5

5461825406bf6d0c29c4e4a59906d215
SHA1

59979be63879761e103e6ea778880874271ef41f
SHA256

c9b40b62421dd5509e511ffd82b9acec00250c424a9f7a191fb094a976fc1d86
SHA512

50d6f6dde669427c4d343628500a871e33671519a27bea28b77bc1fc9d2e1807c568cdd04753bbe6e8efc17e1a8ca76497cbca7489c069056af061df9bf34003
SSDEEP

3072:r+HBczyRUIRK4MRPvuyvmCSsxPGpeQ++x2OHoDkX6P6K9tnrwdTaJ8Fy5A:r+lBCSC+peQ+Y2OhXK/nsdg8eA

Score

1^/10

Malware Config

Signatures

Files

vshadow.exe.2
.exe windows x86

9558560cbfdb419535f9680927a961eb

Code Sign

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:29

Not After

03/03/2021, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:6f:5e:64:67:0e:38:47:99:45:da:82:32:b4:cc:b6:ed:9b:95:ce:29:8a:e6:22:d1:b6:97:a5:7f:28:f3:e6
Signer

Actual PE Digest

5b:6f:5e:64:67:0e:38:47:99:45:da:82:32:b4:cc:b6:ed:9b:95:ce:29:8a:e6:22:d1:b6:97:a5:7f:28:f3:e6

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/04/2023, 09:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetVolumePathNamesForVolumeNameW
WriteFile
CloseHandle
CreateFileW
WideCharToMultiByte
QueryDosDeviceW
GetFileAttributesW
FindFirstFileW
FindClose
FindNextFileW
GetThreadLocale
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
HeapSetInformation
GetExitCodeProcess
LocalFree
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WaitForSingleObject
FormatMessageW
TerminateProcess

msvcrt

??0exception@@QAE@ABQBDH@Z
_CxxThrowException
memcpy
memmove
_errno
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
memset
__uncaught_exception
setlocale
_lock
_unlock
_fsopen
fseek
__pctype_func
isupper
calloc
__iob_func
__mb_cur_max
islower
_wcsdup
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_wcsnicmp
_callnewh
memcmp
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
_except_handler4_common
strcspn
fputwc
ungetwc
fclose
localeconv
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_purecall
_vsnwprintf
wprintf
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
malloc
getchar
_wcsicmp
free
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
sprintf_s
fwrite
memcpy_s
ungetc
fgetc
fgetwc
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
fputc

atl

ord30

oleaut32

SysFreeString
SysAllocString

ole32

CLSIDFromString
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal
ShouldBlockRevertInternal

resutils

ClusterPrepareSharedVolumeForBackup
ClusterIsPathOnSharedVolume
ClusterGetVolumePathName
ClusterGetVolumeNameForVolumeMountPoint

shlwapi

PathFileExistsW

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9558560cbfdb419535f9680927a961eb

Code Sign

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

5b:6f:5e:64:67:0e:38:47:99:45:da:82:32:b4:cc:b6:ed:9b:95:ce:29:8a:e6:22:d1:b6:97:a5:7f:28:f3:e6Signer

Signature Validations

Verification

06/04/2023, 09:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

atl

oleaut32

ole32

vssapi

resutils

shlwapi

Sections

.text Size: 225KB - Virtual size: 225KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

5b:6f:5e:64:67:0e:38:47:99:45:da:82:32:b4:cc:b6:ed:9b:95:ce:29:8a:e6:22:d1:b6:97:a5:7f:28:f3:e6
Signer

06/04/2023, 09:39
Valid: false

.text
Size: 225KB - Virtual size: 225KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB