2023042972471b09e9daaaa4f48719a59651aff3virlock[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2023042972471b09e9daaaa4f48719a59651aff3virlock.bin
Size

753KB
MD5

72471b09e9daaaa4f48719a59651aff3
SHA1

54448164a538184e7d1b5faaa95ff67ed77bbb63
SHA256

53ffaed64981a196c138406e8f0b060357c508eab6cfae0bcd9ce0206a852ac1
SHA512

51bf520a783d72000463f7e4825f862e94c6c49a953e3577d1952f2c1377a60aaee746027a61d795a575a7850de3fd1b33019243f4679c4157ff9828543d87ce
SSDEEP

12288:h/1DTVL5rGF3RUWayQ2aT6DyDrtVmEhfdpcv1OiPVLVgbhsa8HxVpKFM/sKMInbW:HXvrGpvayzaDtV9uv1/OTbTyS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023042972471b09e9daaaa4f48719a59651aff3virlock.bin

Files

2023042972471b09e9daaaa4f48719a59651aff3virlock.bin
.exe windows x86

366332abd1d95ffe3c5b85ebb482f7e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetCursor
TranslateAcceleratorA
CreateWindowStationA
ChangeClipboardChain
DrawTextW

ntdll

ZwImpersonateAnonymousToken
ZwQueryTimer

advapi32

CryptHashData

kernel32

GetCommandLineA

Sections

.text
Size: 748KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE