VirusShare_b0eac46978507264e9c7dddb2722636e

Sharing

Copy URL

Twitter E-mail

General

Target

VirusShare_b0eac46978507264e9c7dddb2722636e
Size

499KB
MD5

b0eac46978507264e9c7dddb2722636e
SHA1

6a4f90ad0384f1eedf4cc404294d3e5b05ca7259
SHA256

e30be1fa4f2fae7b89c891a3fc20099bb58c477fc2e7d4d330e314afe9d274fe
SHA512

546c9fa82e7bb6e3a160dd0bd0c63080037cd5e47ce4ec9a80078e82d8392a947e70dc8a4275abde3ef2c19f00458897b0d7acfac202944f61e9b89d2c93a665
SSDEEP

12288:cwCHlw3CFsyvCzOMMnMMMMMdVZZHL1biHxy0lkDrmKFRAqrI:cwCF0CFs4YOMMnMMMMMdFL1B/9F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VirusShare_b0eac46978507264e9c7dddb2722636e

Files

VirusShare_b0eac46978507264e9c7dddb2722636e
.exe windows:4 windows x86 arch:x86

d3940cd6fd5671440e7c5e2be74e9320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallMsgFilterW

advapi32

RegDeleteValueW
RegSetValueExA
DeregisterEventSource
LookupPrivilegeValueA
ReportEventA
RegQueryValueExW
RegEnumKeyW
RegOpenKeyW
RegSetValueA
RegQueryValueExA
RegDeleteKeyW
RegOpenKeyExA
OpenProcessToken
RegQueryInfoKeyA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExW
RegCreateKeyW
SetSecurityDescriptorDacl
RegCloseKey
RegEnumValueA
RegDeleteValueA
RegCreateKeyA
RegQueryValueA
RegisterEventSourceA
RegOpenKeyA
AdjustTokenPrivileges
RegEnumValueW
RegDeleteKeyA

samlib

SamTestPrivateFunctionsUser
SamConnectWithCreds
SamiLmChangePasswordUser
SamRemoveMultipleMembersFromAlias

kernel32

lstrcmpiA
ReleaseSemaphore
GlobalHandle
MultiByteToWideChar
GetProfileStringA
GetDateFormatA
GetUserDefaultLangID
GetSystemDirectoryA
ResetEvent
CreateThread
TlsSetValue
CreateProcessW
SetEnvironmentVariableA
LeaveCriticalSection
GetStringTypeA
GlobalSize
FindResourceA
GetExitCodeProcess
GetFileType
GetFullPathNameA
CreateMailslotA
GetSystemDefaultLCID
TerminateProcess
MulDiv
GetTimeZoneInformation
GetStringTypeW
GetFileTime
GetEnvironmentStringsW
DeleteFileA
LoadResource
GlobalReAlloc
RtlUnwind
lstrcpyA
UnlockFile
HeapCreate
lstrcpynA
CompareStringA
SetEvent
GetTickCount
VirtualFree
GetVersionExA
SetEndOfFile
WideCharToMultiByte
DeleteCriticalSection
ExitProcess
lstrcatA
FileTimeToLocalFileTime
CloseHandle
TlsFree
FileTimeToSystemTime
HeapDestroy
InterlockedDecrement
GetModuleHandleA
GetACP
GetSystemTime
EnterCriticalSection
FormatMessageW
HeapReAlloc
SetFilePointer
RaiseException
GetTempFileNameA
InterlockedIncrement
_lclose
CompareStringW
FlushFileBuffers
GetModuleFileNameA
LockFile
FormatMessageA
LCMapStringW
GetStringTypeExA
LoadLibraryA
DuplicateHandle
GetCPInfo
IsBadReadPtr
SetLocalTime
GetProcAddress
GetTempPathA
GetCurrentDirectoryA
HeapSize
MoveFileA
SetStdHandle
GetStartupInfoA
lstrlenA
GetModuleFileNameW
CreateProcessA
LCMapStringA
_lwrite
GlobalAddAtomA
FreeEnvironmentStringsW
VirtualProtect
GetLocalTime
SizeofResource
HeapFree
GetSystemDefaultLangID
FreeLibrary
GetEnvironmentStrings
GetCommandLineA
GetVolumeInformationA
GetShortPathNameA
FindFirstFileA
GetLocaleInfoA
GetDriveTypeA
TlsGetValue
GetOEMCP
GetSystemInfo
GetCurrentThreadId
TlsAlloc
FlushInstructionCache
SetErrorMode
GlobalFree
WinExec
SetFileAttributesA
CreateFileA
lstrcmpiW
GetWindowsDirectoryA
HeapAlloc
SetFileTime
GetCurrentProcess
VirtualQuery
GetFileAttributesA
GlobalAlloc
GetUserDefaultLCID
FindClose
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
lstrcmpA
RemoveDirectoryA
IsBadCodePtr
CreateSemaphoreA
IsDBCSLeadByte
SearchPathA
SystemTimeToFileTime
FindNextFileA
Sleep
WriteFile
GetCurrentProcessId
_llseek
ResumeThread
VirtualAlloc
GlobalUnlock
FreeResource
SetCurrentDirectoryA
_lread
GlobalDeleteAtom
CreateDirectoryA
SetLastError
WaitForSingleObject
GetLastError
CreateEventA
ReadFile
InitializeCriticalSection
ExitThread
LockResource
LoadLibraryExA
GlobalLock
FreeEnvironmentStringsA

ddraw

DirectDrawEnumerateA

mswsock

sethostname

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 154KB - Virtual size: 1024KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3940cd6fd5671440e7c5e2be74e9320

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

samlib

kernel32

ddraw

mswsock

Sections

.text Size: 1KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.data Size: 154KB - Virtual size: 1024KB

.rsrc Size: 131KB - Virtual size: 130KB

.reloc Size: 512B - Virtual size: 72B

.rdata Size: 205KB - Virtual size: 205KB

.text
Size: 1KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.data
Size: 154KB - Virtual size: 1024KB

.rsrc
Size: 131KB - Virtual size: 130KB

.reloc
Size: 512B - Virtual size: 72B

.rdata
Size: 205KB - Virtual size: 205KB