VirusShare_5e867ae4a78726523d91eaea386fce6d[.]zip

General

Target

VirusShare_5e867ae4a78726523d91eaea386fce6d.zip
Size

96KB
MD5

fcca72dd17606bdd1ea650ea4f6f428a
SHA1

1eea8f488cfcd7c643963be6da5dd364284ec86c
SHA256

28485c139a6355cb8429d01defe5cb89e8c0c8bfc1ad5f5520341812478000b1
SHA512

fb538a8c62355fd65b1e637e9821fd9139be7b5ac4c821b6faabc2d3b44c397a999df96d2b91c96b2388e754cc5a508e7b1067e2341f1f98d4f6d8f09c7c388a
SSDEEP

1536:iUBSUaDYAJUIJVesh8oQb6VcCIYL1UJLhVZYtEoS1D1Xv5x2pu:iAaHJUILesuoAecHYa/YtE5Xv54pu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/78ca5753c7f93fe3ff553ae23fb87395c36a791b61952eabf6b9d96e59c7862d

Files

VirusShare_5e867ae4a78726523d91eaea386fce6d.zip
.zip

Password: infected
78ca5753c7f93fe3ff553ae23fb87395c36a791b61952eabf6b9d96e59c7862d
.exe windows x86

1f145f44e572e42969bc79e28c2c222b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ctl3d32

Ctl3dGetVer
Ctl3dEnabled
Ctl3dUnregister
Ctl3dRegister
Ctl3dCtlColor

crypt32

CryptMsgGetParam
CertFreeCTLContext
CertGetStoreProperty
CryptFindOIDInfo
CertGetNameStringA
CryptMsgDuplicate
CertFindCTLInStore
CryptMsgUpdate
CryptMemAlloc
CertDeleteCTLFromStore
CryptMsgControl
CertAlgIdToOID
CertCloseStore

cryptdll

MD5Init
MD5Update
MD5Final
CDBuildVect
CDLocateRng

advapi32

RegEnumKeyA
CreateServiceA
RegOpenKeyA
RegSaveKeyA
LogonUserW
RegLoadKeyW
GetUserNameA
RegRestoreKeyW
RegUnLoadKeyW
CryptSignHashA
ReadEventLogW
OpenEventLogW
RegDeleteValueW

user32

MessageBoxW
GetWindow
InsertMenuA
IsWindowVisible
GetMessageW
DispatchMessageW
GetDlgItemTextW
DialogBoxParamW
LoadMenuW
CharToOemW
CreateDesktopA
DrawStateA
IsDialogMessageW
GetClassLongA

kernel32

WriteFile
LoadLibraryExA
GetProcessHeap
OpenJobObjectA
GetLogicalDriveStringsW
lstrlenA
InitializeCriticalSection
SleepEx
CreateMutexW
GetCommandLineA
GetModuleHandleA
GetStringTypeW
GetConsoleAliasW
lstrcpy
HeapFree
CreateFileW
GetACP
GetProcAddress

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

1f145f44e572e42969bc79e28c2c222b

Headers

DLL Characteristics

File Characteristics

Imports

ctl3d32

crypt32

cryptdll

advapi32

user32

kernel32

Sections

.text Size: 118KB - Virtual size: 117KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 976B

.rsrc Size: 18KB - Virtual size: 18KB

.text
Size: 118KB - Virtual size: 117KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 976B

.rsrc
Size: 18KB - Virtual size: 18KB