androidiPhoneViberTransferPlus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

androidiPhoneViberTransferPlus.exe
Size

1.6MB
MD5

b85557e4a4fa1007c8c62d3f9cc2ea19
SHA1

376e236f5e749458fd29707a517e181be5ac2f29
SHA256

7678cd632f2a54023f6965ff02f1e86872a751847abe6b359721ab36675d82a6
SHA512

3a04cde67db2de592ff2a66ce1659ccff9be66d1b1dd7f528a99efb3ecdcfb69c5bd3433d7ab8f3435218d249519bebd9f140142d94cc588ea718af7fe09bb7d
SSDEEP

49152:7o4mdVe8PpqS3HRxTESPKPw21NhL5PAwrS/O9vuQWPh/Iws:7orPpqWHzESPKPw21H5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
androidiPhoneViberTransferPlus.exe

Files

androidiPhoneViberTransferPlus.exe
.exe windows:6 windows x64 arch:x64

9381ce462880f36d733586af0813f044

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

ws2_32

htons

shell32

ShellExecuteW

iphlpapi

GetExtendedTcpTable

sqlite_qt8

sqlite3_exec

archive

archive_read_new

libcurl

curl_easy_init

libcrypto-1_1-x64

BIO_new

libplist2

plist_free

libmobiledevice

idevice_free

libadb

??_7AdbPoll@@6B@

qtwebkit4

??1QWebView@@UEAA@XZ

qtgui4

??1QMenu@@UEAA@XZ

qtnetwork4

??1QHttp@@UEAA@XZ

qtcore4

inflate

msvcp140

?_BADOFF@std@@3_JB

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-time-l1-1-0

_utime64

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.MPRESS1
Size: 1.4MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9381ce462880f36d733586af0813f044

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

shell32

iphlpapi

sqlite_qt8

archive

libcurl

libcrypto-1_1-x64

libplist2

libmobiledevice

libadb

qtwebkit4

qtgui4

qtnetwork4

qtcore4

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.MPRESS1 Size: 1.4MB - Virtual size: 2.7MB

.MPRESS2 Size: 3KB - Virtual size: 2KB

.rsrc Size: 266KB - Virtual size: 265KB

.MPRESS1
Size: 1.4MB - Virtual size: 2.7MB

.MPRESS2
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 266KB - Virtual size: 265KB