Virus[.]Win32[.]Sality[.]sil-cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be

Sharing

Copy URL Twitter E-mail

General

Target
Virus.Win32.Sality.sil-cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be
Size 1.5MB
Sample240229-pwf3aahb7w
SHA256 cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be
MD5 56c220a7640a313b73378b537964d884
SHA1 94bc21189b9bef0e534b488f6821b5150970967d
SHA512 5506b76936ea0119ec869e147209cbac1d4fa2c2c86f78bbfe934b2622fe96a9000d0ad46a6c8ddf0fe2b846ab4b074241bc29f66f3420402cefe4594f7d49f9
SSDEEP 24576:dcs3MKLBDY7Ryy0fNRqTb+UO8lZN899ysIOmQuKa/57HaLtVDpEYfMonwuk4:j1LBUPoj6tv49yL2Pa9SV7414
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Virus.Win32.Sality.sil-cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be

File Explorer

Virus.Win32.Sality.sil-cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be

.exe 1.5MB

Virus.Win32.Sality.sil-cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be

IMPHASH 86f649127f320d79de0c023a60ef77bf
SHA256 cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be
MD5 56c220a7640a313b73378b537964d884
SHA1 94bc21189b9bef0e534b488f6821b5150970967d
SHA512 5506b76936ea0119ec869e147209cbac1d4fa2c2c86f78bbfe934b2622fe96a9000d0ad46a6c8ddf0fe2b846ab4b074241bc29f66f3420402cefe4594f7d49f9
SSDEEP 24576:dcs3MKLBDY7Ryy0fNRqTb+UO8lZN899ysIOmQuKa/57HaLtVDpEYfMonwuk4:j1LBUPoj6tv49yL2Pa9SV7414
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10045

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA FreeSid RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

lstrcatA GetFileAttributesA GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA GetCurrentProcess lstrlenA lstrcmpiA lstrcpyA GetModuleFileNameA FreeLibrary LocalAlloc GetLastError GetSystemDirectoryA LoadLibraryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA _lclose _llseek _lopen GetWindowsDirectoryA GetProcAddress RemoveDirectoryA GlobalUnlock GlobalLock GlobalAlloc IsDBCSLeadByte ExitProcess GetModuleHandleA CloseHandle GetCommandLineA LoadResource FindResourceA CreateMutexA SetEvent CreateEventA SetCurrentDirectoryA CreateThread ResetEvent TerminateThread GetVersionExA LocalFree GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA FreeResource LockResource SizeofResource CreateFileA ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetTempFileNameA GetSystemInfo GetDriveTypeA lstrcpynA GetVolumeInformationA GetCurrentDirectoryA LoadLibraryExA GetStartupInfoA CreateDirectoryA GlobalFree FormatMessageA GetDiskFreeSpaceA MulDiv

gdi32

GetDeviceCaps

user32

wsprintfA ExitWindowsEx CharNextA CharUpperA EndDialog GetDesktopWindow CharPrevA GetWindowLongA CallWindowProcA GetDlgItem SetForegroundWindow SetWindowTextA SendDlgItemMessageA SetWindowLongA EnableWindow SendMessageA LoadStringA MsgWaitForMultipleObjects PeekMessageA MessageBoxA SetWindowPos ReleaseDC GetDC GetWindowRect ShowWindow DialogBoxIndirectParamA SetDlgItemTextA MessageBeep GetDlgItemTextA DispatchMessageA

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA