git[.]exe[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

git.exe.vir
Size

6.3MB
MD5

3409692a6ee94fa8610ecc701daf425b
SHA1

bbf6ab31fe073f0dd8e472477f2290f985fd6f34
SHA256

e114db6b2a83af413fb7f7e841231ef5bf2602a57ec2587320d8cc5dbc34a482
SHA512

3f94bb364490c7bc7e2ab4eadc68fda6a82a4f8d860f17f6d42d9d49e3c0f483fd8946b15c2f3a9ebc9ba484246aa89950074bb60ca6c015c6bec1224877a5c0
SSDEEP

196608:nKSG6lc81n72BQhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhJ:KSG6a8R72BqLOA

Score

1^/10

Malware Config

Signatures

Files

git.exe.vir
.exe windows:5 windows x64

de4b8987d5adb218127887fa4130e9e8

Code Sign

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/04/2021, 00:00

Not After

05/04/2024, 23:59

Subject

CN=KC SOFTWARES SASU,O=KC SOFTWARES SASU,L=AUTERIVE,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:1b:66:1d:7b:8a:90:4a:31:ef:05:c0:4c:f2:4c:fc:1b:07:99:1b:8f:d3:2f:d8:f6:14:94:fd:0f:4d:f3:8a
Signer

Actual PE Digest

bc:1b:66:1d:7b:8a:90:4a:31:ef:05:c0:4c:f2:4c:fc:1b:07:99:1b:8f:d3:2f:d8:f6:14:94:fd:0f:4d:f3:8a

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_DragEnter
ImageList_DragShowNolock
ImageList_EndDrag
ImageList_BeginDrag
ImageList_SetIconSize
ord17
ImageList_AddMasked
ImageList_GetImageCount
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_DragMove
ImageList_Draw

shlwapi

PathCompactPathExW
PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW
PathGetDriveNumberW
PathIsRelativeW
PathMatchSpecW
PathStripPathW
PathAppendW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
AssocQueryStringW
PathCombineW
PathFindFileNameW

shell32

DragQueryPoint
DragQueryFileW
ShellExecuteW
ord165
SHGetFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHCreateItemFromParsingName
DragFinish

dbghelp

ImageNtHeader

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CryptQueryObject
CertGetNameStringW
CertNameToStrW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

wintrust

WinVerifyTrust

sensapi

IsNetworkAlive
IsDestinationReachableW

wininet

InternetCrackUrlW

kernel32

GetFileAttributesExW
GetFullPathNameW
GetLongPathNameW
SetFileAttributesW
lstrcpyW
MoveFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GlobalUnlock
GlobalLock
GetCurrentDirectoryW
GlobalAlloc
FormatMessageW
LCMapStringW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
lstrcmpiW
FreeLibrary
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCurrentThreadId
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
CopyFileW
CreateFileW
GetCurrentProcess
GetCurrentProcessId
LoadLibraryW
ReleaseMutex
CreateMutexW
Sleep
GlobalSize
lstrcpynW
WaitForMultipleObjects
CopyFileExW
GetSystemInfo
CreateDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLocalTime
GetTempPathW
SetLastError
CancelIo
SleepEx
WaitForSingleObjectEx
QueueUserAPC
ReadDirectoryChangesW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
CompareStringW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
CompareFileTime
lstrlenW
lstrcmpW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
GetACP
GlobalFree
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetVersion
MulDiv
LocalFree
DeleteFileW
LocalAlloc
GetLastError
OutputDebugStringW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
ReadFile
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
WriteFile
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
ReadConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
GetFileSizeEx
IsValidCodePage
GetOEMCP
HeapReAlloc
RtlUnwind
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
GetVersionExW

user32

IsCharLowerW
GetClassNameA
CreateAcceleratorTableW
FindWindowW
ShowCursor
CreateDialogIndirectParamW
SystemParametersInfoW
MonitorFromRect
TrackMouseEvent
GetCapture
SetRectEmpty
AppendMenuW
RegisterWindowMessageW
CreateCursor
DestroyCursor
ScrollWindow
SetPropW
GetPropW
RemovePropW
SetScrollInfo
LoadStringW
InsertMenuItemW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
DrawIcon
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
TrackPopupMenu
FlashWindowEx
RegisterClassExW
UnregisterClassW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
MapWindowPoints
BringWindowToTop
ReleaseCapture
GetActiveWindow
GetDlgCtrlID
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetParent
GetCursorPos
RedrawWindow
IsChild
GetClassNameW
FindWindowExW
EnumChildWindows
GetAsyncKeyState
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuW
GetMenuItemCount
EnableMenuItem
CheckMenuItem
DestroyMenu
CreatePopupMenu
CreateMenu
GetMenuState
ScreenToClient
EmptyClipboard
SetClipboardData
IsWindow
GetDlgItemInt
FrameRect
FillRect
DrawFocusRect
GetDlgItemTextA
InflateRect
GetSysColor
ClientToScreen
GetWindowRect
IsCharAlphaW
ShowWindow
IsClipboardFormatAvailable
RegisterClipboardFormatW
GetClipboardData
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
LoadCursorW
GetParent
GetWindowLongW
LoadMenuW
IsDialogMessageW
SetMenu
RealChildWindowFromPoint
GetMonitorInfoW
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
SetCursor
MessageBeep
GetClientRect
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
DrawTextExW
DrawTextW
GetMenu
GetSystemMetrics
ToAscii
GetKeyboardState
GetFocus
SetWindowPlacement
GetWindowPlacement
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostMessageW
DrawFrameControl
DrawEdge
SetWindowPos
SetFocus
MoveWindow
DrawIconEx
LoadImageW
EnableWindow
GetKeyState
SendDlgItemMessageW
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
SetDlgItemTextA
GetDlgItem
CallWindowProcW
SendMessageW
MessageBoxW
wsprintfW
MonitorFromWindow
CheckMenuRadioItem
SetForegroundWindow
IsCharAlphaNumericW
CharLowerW
IsWindowVisible
SetMenuItemBitmaps
DeleteMenu
DrawMenuBar
GetMenuStringW
TranslateAcceleratorW
DestroyAcceleratorTable
IsZoomed
IsIconic
ModifyMenuW
GetMenuItemID
GetSubMenu
RemoveMenu
DestroyIcon
LoadIconW
GetDesktopWindow
PtInRect
WindowFromPoint
LockWindowUpdate
GetDCEx
CharUpperW
mouse_event
SetDlgItemInt
LoadBitmapW
GetComboBoxInfo
GetSysColorBrush
CreateDialogParamW
MessageBoxA
SetCapture

gdi32

SetWindowOrgEx
OffsetWindowOrgEx
CreateBitmap
CreatePatternBrush
PatBlt
SetBrushOrgEx
CreateFontIndirectW
GetObjectW
SaveDC
RestoreDC
BitBlt
GetPixel
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetTextMetricsW
EnumFontFamiliesExW
SetTextAlign
StartDocW
EndDoc
StartPage
EndPage
ExtTextOutW
DPtoLP
GetTextExtentPointW
StretchBlt
MoveToEx
LineTo
CreateHatchBrush
SetTextColor
SetROP2
SetBkMode
SelectObject
Rectangle
GetTextExtentPoint32W
GetStockObject
GetROP2
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW
SetBkColor
GetDeviceCaps
CreateFontA

comdlg32

PrintDlgW
ChooseColorW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
IsTextUnicode

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 774KB - Virtual size: 773KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de4b8987d5adb218127887fa4130e9e8

Code Sign

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

bc:1b:66:1d:7b:8a:90:4a:31:ef:05:c0:4c:f2:4c:fc:1b:07:99:1b:8f:d3:2f:d8:f6:14:94:fd:0f:4d:f3:8aSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

shell32

dbghelp

version

crypt32

wintrust

sensapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

ole32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 774KB - Virtual size: 773KB

.data Size: 43KB - Virtual size: 122KB

.pdata Size: 70KB - Virtual size: 70KB

.rsrc Size: 458KB - Virtual size: 457KB

.reloc Size: 13KB - Virtual size: 12KB

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

bc:1b:66:1d:7b:8a:90:4a:31:ef:05:c0:4c:f2:4c:fc:1b:07:99:1b:8f:d3:2f:d8:f6:14:94:fd:0f:4d:f3:8a
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 774KB - Virtual size: 773KB

.data
Size: 43KB - Virtual size: 122KB

.pdata
Size: 70KB - Virtual size: 70KB

.rsrc
Size: 458KB - Virtual size: 457KB

.reloc
Size: 13KB - Virtual size: 12KB