infected[.]exe[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

infected.exe.vir
Size

29.2MB
MD5

1462dc7e53101240c3c02fe784075b5a
SHA1

41846b897ec18f5c0efc8b152bc6fa3e13c1e409
SHA256

b02e617aea887022975e6b70ec7c6eced8ecc16bf0da1bea44bada780915cd3d
SHA512

930312154d636cd4fa34a887790cd3a3c1a70b1ba620018f00a7b12596d29deab72d6f154a94fd76c98d17738a8fda5b8395030cdb02c1f7450c7abf20414006
SSDEEP

196608:yEJtI8wz/6etMlOpEigB3G5AgpchT9+nNMlryfaojQ2WgJlTGPUwZRskQx1Z18wF:Fe8wzSLsTE0p/5fauQ2524Zm9rR3LO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
infected.exe.vir

Files

infected.exe.vir
.exe windows:6 windows x64 arch:x64

cacdb59f44573e536e6d423781439c25

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
GetUserNameW
OpenProcessToken
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExA
RegDeleteValueA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetKeyParam
CryptGetProvParam
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
RegSetValueExA
RegCloseKey

ws2_32

WSAStartup
gethostname
ntohl
socket
closesocket
getaddrinfo
freeaddrinfo

userenv

GetUserProfileDirectoryW

kernel32

GetFileInformationByHandle
GetFullPathNameW
GetVolumeInformationW
RemoveDirectoryW
SetFileAttributesW
DeviceIoControl
FormatMessageW
ReadFile
GetModuleHandleExW
GetFileType
PeekNamedPipe
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetSystemTimeAsFileTime
GetProcessAffinityMask
GetFileAttributesW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
GetFileSizeEx
GetDiskFreeSpaceW
GetDriveTypeW
SetLastError
FormatMessageA
GetUserDefaultLCID
GetUserGeoID
GetGeoInfoA
GetLocaleInfoA
MultiByteToWideChar
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetACP
IsValidCodePage
GetWindowsDirectoryA
GetSystemDirectoryA
WakeAllConditionVariable
WaitForSingleObject
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
ReOpenFile
SetFilePointerEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
SwitchToThread
SleepConditionVariableCS
Sleep
SetEvent
ResumeThread
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetVersionExA
GetTempPathW
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetLastError
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetCurrentDirectoryW
FlushFileBuffers
EnterCriticalSection
DuplicateHandle
CreateFileW
CreateFileMappingW
CreateEventA
CloseHandle
AddVectoredContinueHandler

vcruntime140

__current_exception
wcschr
wcsrchr
memset
memcpy
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

raise
exit
_seh_filter_exe
_set_app_type
_beginthreadex
terminate
_errno
_exit
_crt_atexit
_register_onexit_function
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv

api-ms-win-crt-environment-l1-1-0

_wgetcwd
_wgetenv
_wgetdcwd
getenv

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
free
malloc
_set_new_mode
calloc

api-ms-win-crt-string-l1-1-0

iswctype
wcscmp
strcpy
wcscpy
wcsncmp
_wcsupr
strcat
wcscat
wcsncat
wcslen
strlen
strcmp
towupper
isdigit
_strdup

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoull
atoi
_itoa_s

api-ms-win-crt-stdio-l1-1-0

fputs
__stdio_common_vsprintf
__acrt_iob_func
fclose
__stdio_common_vfprintf
_set_fmode
fopen
__stdio_common_vsscanf
__p__commode

api-ms-win-crt-filesystem-l1-1-0

_wfullpath
_wrename

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ncrypt

NCryptEncrypt
NCryptDecrypt
NCryptExportKey

iphlpapi

GetIfEntry2
GetIfTable2
GetUnicastIpAddressTable
GetAnycastIpAddressTable
FreeMibTable
ConvertInterfaceNameToLuidW
ConvertInterfaceLuidToNameW
ConvertLengthToIpv4Mask

Exports

Exports

IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__f6667de81ba3372976bb88a1ffd53978a14e5062
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__d9d51255c13e1e63932724fc45c8d9d7d992f5cb
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__d04f70c150119a1a6df693cde53c8a58128d5e2b
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__e8b0041f4e89ff307dd3640c69c109d0d8139b8e
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1cff6a2f13f336178f12f2558128228775e047f6
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__e18826d035036aa5606c61e869f37df97fe5892f
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__7f4c88f0402ae949ca8b3e2b3a3e6235b49772f0
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__ba182be51e30552971cbbdb9960f52a7ebc17ff8__62fa6fcb73a0e0d2fda77bdbf26359facfbaa734
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__8349780683d23085ca6fca3423ec245733e16c32__3abce4986f080175b20b8a8b5e7458bfdda881e4
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__8fe7b7a26fde0b5d6373df2756c2f2545cfc5fed__2c881359d3c4c7f4c4da4479a1cee5896becfb6b
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__092e385b15f846acab22b8180eb675720c49e4f8
JDK_LoadSystemLibrary
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
JNU_CallMethodByName
JNU_CallMethodByNameV
JNU_CallStaticMethodByName
JNU_ClassString
JNU_GetEnv
JNU_GetFieldByName
JNU_GetStaticFieldByName
JNU_IsInstanceOfByName
JNU_NewObjectByName
JNU_NewStringPlatform
JNU_SetFieldByName
JNU_ThrowArrayIndexOutOfBoundsException
JNU_ThrowByName
JNU_ThrowIOException
JNU_ThrowIllegalArgumentException
JNU_ThrowInternalError
JNU_ThrowNullPointerException
JNU_ThrowOutOfMemoryError
JVM_CurrentTimeMillis
JVM_RaiseSignal
__svm_code_section
__svm_version_info
__svm_vm_java_version
__svm_vm_target_ccompiler
__svm_vm_target_libc
__svm_vm_target_libraries
__svm_vm_target_platform
__svm_vm_target_staticlibraries
getEncodingFromLangID
getJavaIDFromLangID
graal_attach_thread
graal_create_isolate
graal_detach_all_threads_and_tear_down_isolate
graal_detach_thread
graal_get_current_thread
graal_get_isolate
graal_tear_down_isolate
jio_snprintf
main

Sections

.text
Size: 16.7MB - Virtual size: 16.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 12.3MB - Virtual size: 12.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cacdb59f44573e536e6d423781439c25

Headers

DLL Characteristics

File Characteristics

Imports

version

advapi32

ws2_32

userenv

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ncrypt

iphlpapi

Exports

Exports

Sections

.text Size: 16.7MB - Virtual size: 16.7MB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 8KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 3KB

.rodata Size: 68KB - Virtual size: 64KB

.svm_hea Size: 12.3MB - Virtual size: 12.3MB

.reloc Size: 76KB - Virtual size: 73KB

.text
Size: 16.7MB - Virtual size: 16.7MB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 8KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 3KB

.rodata
Size: 68KB - Virtual size: 64KB

.svm_hea
Size: 12.3MB - Virtual size: 12.3MB

.reloc
Size: 76KB - Virtual size: 73KB