VirusShare_9213073f63c1542315acdad27c0b8b78 | Triage

Sharing

General

Target

VirusShare_9213073f63c1542315acdad27c0b8b78
Size

360KB
MD5

9213073f63c1542315acdad27c0b8b78
SHA1

77b5765cd37ccfb7608611291d66e68b7d68e2dc
SHA256

1356acd718a156e106163e91fa87a415e4f6855606d2712d8408d65190a95dad
SHA512

9ae5d76345825b0cd012d4ce8189a1b6864b3d76be93ae7fad22eb28387097346213d7763a989098ae2dd5a921afd3ab8ef72cc308d4d9bfc8e7e7efa3a92735
SSDEEP

6144:YaaRWvS8RStjunQ/ocbbOeEQZlPX6kKhWbyFqoMU2sEEbsOI/4Yi:YFWvNS8EE4+WOeU22bnI/4Yi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
VirusShare_9213073f63c1542315acdad27c0b8b78

Files

VirusShare_9213073f63c1542315acdad27c0b8b78
.exe windows:4 windows x86 arch:x86

9db09ebe469b71e3c2a82229fc807185

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memcpy

pdh

PdhReadRawLogRecord

kernel32

GetProcAddress
lstrlenW
GetCommandLineW
TerminateProcess
CreateThread
GetNumberFormatW
UnmapViewOfFile
SetEvent
OpenFileMappingW
GetModuleHandleA
FreeLibrary
MapViewOfFile
GetCurrentProcessId
GetLastError
VirtualQuery
LocalAlloc
GetExitCodeProcess
GetCurrentThreadId
CreateEventW
UnhandledExceptionFilter
VirtualProtect
FreeConsole

user32

GetClassNameA
GetShellWindow

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

O_8!Iz
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ