virus_deobfus[.]7z | Triage

Sharing

General

Target

virus_deobfus.7z
Size

250KB
MD5

f425ffa359b5736cde40d4748a38429a
SHA1

dd25d1b17cffc460bb721a471233415d3b2a6443
SHA256

b3bc59c0c2086e236f534eed24a9fe4b815f2ad2e85e609dd1f398d0a73a77ea
SHA512

5b28389726702162425353b4eecf9b2bdfe6823cf8824f4e473bc17165732e4019887e5219aa13191abc13982d5d62457d8579330711426167dcda355775d9cc
SSDEEP

6144:Vup9+0g5EVsi2MRVC085aJeX69L1YG+FiKbbMyE2Vb60ARI:V+E5EVs245aJvRYG+FvbMyE2MRI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/exe

Files

virus_deobfus.7z
.7z

Password: infected
exe
.exe windows:6 windows x86 arch:x86

41482c048643282f0fa54f6385f74814

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetStdHandle
QueryPerformanceFrequency

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetDIBits
GetDeviceCaps
GetObjectW
SelectObject

user32

GetDC
ReleaseDC

Sections

.text
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

xwq
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE