Behavioral task
behavioral1
Sample
VirusShare-c0f7400c244bb827e74590f8e365dd12.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
VirusShare-c0f7400c244bb827e74590f8e365dd12.exe
Resource
win10v2004-20231215-en
General
-
Target
VirusShare-c0f7400c244bb827e74590f8e365dd12
-
Size
313KB
-
MD5
c0f7400c244bb827e74590f8e365dd12
-
SHA1
75ccd4cd2798b6d1dfc6a4d180147c60f75012bb
-
SHA256
6a9215766ad0df0f48c31b075a7cf5c813fb45d638be9cda895924a52a893c89
-
SHA512
e0bb318f578bb18fdfe5b40d6cc27059158c47aebd3a8199cf2991076fc005ce5b8f32540bcdf4d17a63891f6f54a6724ab5a82a489e51f1f021436645a4e6ec
-
SSDEEP
6144:izB5/6SpnsQVpWW52UzOawUE0cWRxPjHylQ3DCUwX9gxN6XXEW4I:E7ZVRfEnWrjSlQzSXtR
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_References_SecTools -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare-c0f7400c244bb827e74590f8e365dd12
Files
-
VirusShare-c0f7400c244bb827e74590f8e365dd12.exe windows:4 windows x86 arch:x86
80aa227fc4304999bfc9879848198eee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
TransactNamedPipe
GetCurrentThread
GetCurrentProcess
CreateEventA
GetTempPathA
MultiByteToWideChar
GetLastError
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
CreateThread
TerminateThread
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
CloseHandle
ReadFile
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
ExpandEnvironmentStringsA
CreateProcessA
GetSystemDirectoryA
ExitProcess
DeleteFileA
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetTickCount
advapi32
StartServiceA
RegQueryInfoKeyA
RegEnumKeyExA
DeleteService
ControlService
EnumServicesStatusA
RegQueryValueExA
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCloseKey
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
dnsapi
DnsQuery_A
mpr
WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetAddConnection2W
msvcp60
?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ
msvcrt
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
sprintf
isdigit
calloc
printf
perror
_errno
strerror
fflush
sscanf
wcstombs
mbstowcs
wcscpy
memchr
_except_handler3
fprintf
toupper
fputc
__CxxFrameHandler
wcscat
strtok
_ftol
rand
srand
__p__commode
ftell
malloc
free
strcat
exit
strncmp
_memccpy
_stricmp
atof
strchr
__p__fmode
__set_app_type
_controlfp
strncat
memcmp
system
atoi
strcpy
fgets
strcmp
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
fopen
fclose
fseek
fread
memset
strstr
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
fwrite
_strdup
netapi32
NetUseDel
NetApiBufferFree
NetShareEnum
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
NetUseAdd
odbc32
psapi
GetModuleBaseNameA
EnumProcesses
EnumProcessModules
shell32
ShellExecuteA
user32
wsprintfA
GetAsyncKeyState
GetKeyState
GetWindowTextA
GetForegroundWindow
ExitWindowsEx
ws2_32
WSASocketA
WSAIoctl
Sections
UPX0 Size: 308KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE