Static task
static1
Behavioral task
behavioral1
Sample
SetupOvlSig.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SetupOvlSig.exe
Resource
win10v2004-20231023-en
General
-
Target
SetupOvlSig.exe.vir
-
Size
556KB
-
MD5
ba924b8bfd789d53ac00086f370f0823
-
SHA1
97a7a04484d03abf2cd7f292f872f29d8ff5c13d
-
SHA256
a0eba50219f9e798920a2e2c7b22c6f78088eb6a5530f5ae5a52714d45269100
-
SHA512
fc6c3a3a3351dff230b4ddbab4a79b45c2595831befbe6b8bbcfb98a055d75e3dfcb347e10d063ba2ca7108095f4c302892aea35f84fd4c028e3e0aad73005df
-
SSDEEP
6144:soEjkk/4oCKgMBmxR1fOVrkgsnAnhm97sJemGzh+tX6qzu6kHct6feKPM2kM:soEj00By1fOdAnAkUt8PcmM2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SetupOvlSig.exe.vir
Files
-
SetupOvlSig.exe.vir.exe windows:6 windows x64 arch:x64
8d6510eb6c04cf8a10eb9fa11628029f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeviceIoControl
GetModuleFileNameW
CreateFileW
GetTempPathA
CreateFileA
CloseHandle
WriteFile
GetProcAddress
GetFileSize
GlobalMemoryStatusEx
GetModuleHandleW
CreateFileMappingW
MapViewOfFile
CheckRemoteDebuggerPresent
GetSystemInfo
GetCurrentProcess
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
MultiByteToWideChar
MoveFileExW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
GetFileType
GetLastError
GetTickCount
LocalFree
GetFileSizeEx
GetFileTime
ReadFile
SetFilePointerEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetCommandLineA
GetCommandLineW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
RtlUnwind
shell32
ShellExecuteA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenW
shlwapi
PathFindFileNameW
bcrypt
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptDestroyKey
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptDeriveKeyPBKDF2
BCryptGenRandom
BCryptGetProperty
advapi32
GetSecurityInfo
Sections
.text Size: 315KB - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ