Virus[.]Win32[.]Sality[.]sil-be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0

Sharing

Copy URL Twitter E-mail

General

Target
Virus.Win32.Sality.sil-be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0
Size 183KB
Sample240229-pwcd4ahf45
SHA256 be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0
MD5 22565ed599c5490320b8e06a3b18771c
SHA1 14061f2212a29f2ecbbaae39d41bf8f928c4099c
SHA512 e66a139327b30b69af0daadfa462bcfbc84c65444c1fe8298e9fc1d9de5524c8cf9b6aba2757b94dc7ecfeb3510697e5e80d20711b8aa42a431e2d5712c16b79
SSDEEP 3072:C0a2o8/1AWl9XtA6yjuNGhXJec7oMcRjPHJLt9WWIItfjnIRcqD2XK7xkQnN:C52v/1AWl9XtujLkFjlWWrFI4XK9kw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Virus.Win32.Sality.sil-be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0

File Explorer

Virus.Win32.Sality.sil-be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0

.exe 183KB

Virus.Win32.Sality.sil-be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0

IMPHASH b9d2a93cf19ca49f2a88ab66d2e71f6f
SHA256 be9485c5201cfbdd43855e7135a10d2fbe3711d073dee324ff2af3d53c4544e0
MD5 22565ed599c5490320b8e06a3b18771c
SHA1 14061f2212a29f2ecbbaae39d41bf8f928c4099c
SHA512 e66a139327b30b69af0daadfa462bcfbc84c65444c1fe8298e9fc1d9de5524c8cf9b6aba2757b94dc7ecfeb3510697e5e80d20711b8aa42a431e2d5712c16b79
SSDEEP 3072:C0a2o8/1AWl9XtA6yjuNGhXJec7oMcRjPHJLt9WWIItfjnIRcqD2XK7xkQnN:C52v/1AWl9XtujLkFjlWWrFI4XK9kw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA VerInstallFileA

kernel32

LoadResource FindResourceA GetModuleHandleA SetErrorMode CreateDirectoryA GetModuleFileNameA CreateFileA InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency CreateEventA CloseHandle WriteFile Sleep ReadFile FreeLibrary RemoveDirectoryA FindClose FindNextFileA DeleteFileA lstrcmpA FindFirstFileA GetTempPathA LeaveCriticalSection EnterCriticalSection CreateThread GetWindowsDirectoryA GetTickCount GetFileAttributesA GetTempFileNameA CreateMutexA WaitForSingleObject ReleaseMutex InitializeCriticalSection DeleteCriticalSection lstrlenW SetEvent LockResource GetDriveTypeA OpenEventA CreateProcessA CopyFileA GetShortPathNameA GetCurrentThreadId HeapAlloc GetSystemInfo HeapCreate GetFileSize lstrcpynA lstrcatA WritePrivateProfileStringA GetProcAddress LoadLibraryA HeapDestroy GetSystemDefaultLangID MoveFileA FindResourceExA UnmapViewOfFile MapViewOfFile CreateFileMappingA SizeofResource GetVersion GetStartupInfoA ExitProcess GetCommandLineA DebugBreak HeapReAlloc HeapFree VirtualQuery VirtualProtect SearchPathA ResetEvent QueryPerformanceCounter SystemTimeToFileTime GetCurrentProcess GetCurrentThread RtlUnwind lstrcpyA GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetVersionExA CompareStringW CompareStringA WideCharToMultiByte lstrlenA GetLastError SetLastError lstrcmpiA GetPrivateProfileIntA GetPrivateProfileStringA MultiByteToWideChar GetStringTypeA GetStringTypeW SetFilePointer IsBadReadPtr

user32

MoveWindow KillTimer DestroyWindow GetWindowTextA SetTimer SetWindowRgn GetDesktopWindow DialogBoxIndirectParamA SetActiveWindow LoadStringA SetWindowTextA GetDlgItem SendMessageA SetDlgItemTextA LoadIconA GetWindowRect SystemParametersInfoA SetWindowPos wsprintfA MsgWaitForMultipleObjects PeekMessageA CharLowerBuffA MessageBoxA EndDialog CharNextA CharUpperA PostThreadMessageA CreateDialogIndirectParamA SetForegroundWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC ShowWindow ScreenToClient

gdi32

GetTextExtentPoint32A LPtoDP DeleteObject CreateFontIndirectA GetObjectA

advapi32

RegCreateKeyExA GetTokenInformation AllocateAndInitializeSid OpenThreadToken EqualSid FreeSid RegCloseKey RegOpenKeyExA RegSetValueExA OpenProcessToken RegDeleteKeyA RegEnumKeyExA RegQueryValueExA RegOpenKeyA RegQueryValueA

shell32

SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation

ole32

CoCreateGuid CoCreateInstance CoRevokeClassObject CoRegisterClassObject StringFromCLSID CoTaskMemFree StringFromGUID2 GetRunningObjectTable CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream CoReleaseMarshalData CoInitialize CoGetInterfaceAndReleaseStream CoUninitialize

oleaut32

RegisterTypeLi LoadTypeLi LoadRegTypeLi SysFreeString VariantCopy SysAllocStringLen SysAllocString SysStringLen VariantClear

lz32

LZOpenFileA LZCopy LZClose