Bhavesh Virus Maker v1[.]0[.]0[.]1[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Bhavesh Virus Maker v1.0.0.1.zip
Size

3.4MB
MD5

fc611459d76232259ac3fd1f3456d60a
SHA1

3407a2b1b913239e8b70786160b6584a1577d151
SHA256

5bb924807d43e98d404a520d35446eca67ada7a30218360bd6325e10deb9c309
SHA512

a430e5d4c7d61f62ed362ef1bdb87d68610d4d11b718a0208fb73f6270471b255bf3465955b0ec9a9ed8a766b38872d5b33187b87d0223d3694ea6fb577edf12
SSDEEP

98304:dsZIvTsbwbPTRBXC3YmX98h2xjs+G1VxdPbsRIv4:aev4+7XCBjC+G1VnwGv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.exe
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Easy Binder.exe
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.deploy
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.exe
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll
unpack001/Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.deploy

Files

Bhavesh Virus Maker v1.0.0.1.zip
.zip
Bhavesh Virus Maker/Bhavesh Virus Maker.sln
Bhavesh Virus Maker/Bhavesh Virus Maker.v11.suo
Bhavesh Virus Maker/Bhavesh Virus Maker/App.config
.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/Bhavesh Virus Maker.vbproj
Bhavesh Virus Maker/Bhavesh Virus Maker/Bhavesh Virus Maker.vbproj.user
Bhavesh Virus Maker/Bhavesh Virus Maker/Bhavesh Virus Maker_TemporaryKey.pfx
Bhavesh Virus Maker/Bhavesh Virus Maker/Form1.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/Form1.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/Form1.vb
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/Malware-icon.ico
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Application.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Application.myapp
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/AssemblyInfo.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Resources.Designer.vb
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Resources.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Settings.Designer.vb
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/My Project/Settings.settings
Bhavesh Virus Maker/Bhavesh Virus Maker/bhAbout.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bhAbout.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bhAbout.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.application
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\BHAVESH\Documents\Visual Studio 2012\Projects\Bhavesh Virus Maker\Bhavesh Virus Maker\obj\Debug\Bhavesh Virus Maker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 644KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.exe.config
.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.exe.manifest
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.pdb
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.vshost.application
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.vshost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09-01-2012 22:25

Not After

09-04-2013 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-07-2012 00:14

Not After

07-10-2013 00:14

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

97:f7:fb:00:2c:9c:38:8a:15:ae:14:8f:92:25:0a:ff:c5:74:22:e3:ef:03:94:b5:e5:bc:62:43:20:4e:97:f7
Signer

Actual PE Digest

97:f7:fb:00:2c:9c:38:8a:15:ae:14:8f:92:25:0a:ff:c5:74:22:e3:ef:03:94:b5:e5:bc:62:43:20:4e:97:f7

Digest Algorithm

sha256

PE Digest Matches

true

24:92:4f:34:68:12:d8:8d:95:d3:b0:98:0b:0c:33:72:74:92:40:15
Signer

Actual PE Digest

24:92:4f:34:68:12:d8:8d:95:d3:b0:98:0b:0c:33:72:74:92:40:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\binaries\Intermediate\vsproject\vshostneutral.csproj__520862691\objr\x86\vshost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.vshost.exe.config
.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.vshost.exe.manifest
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Bhavesh Virus Maker.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Easy Binder.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Administrator\My Documents\Visual Studio 2005\Projects\binder\obj\Release\Easy Binder.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/angel.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/aspxspy.php
.asp .js polyglot
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/b374k.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/bv7binary.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/commandshell.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/cyberwarrior.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/ernebypass.php
.html .js polyglot
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/g6shell.php
.html
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/gazashell.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/h4cker.tr.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/kacak.php
.html .vbs polyglot
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/lostdcshell.php
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/pouyaserver.php
.asp .vbs polyglot
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/r57.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/saudishell.php
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/simattacker.php
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/sosyeteshell.php
.html
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/symlink.php
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/syrianshellv8.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/tryagshell.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/uploadshell_hima.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/webadmin.php
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/webroot.php
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Shell/zehir4shell.php
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/elk cloner.a02.txt
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/email flooder.js.txt
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/fakejs.txt
.html .js polyglot
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/hacksparrow.txt
.js
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/hunatcha.c.txt
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/i love you virus.vbs.txt
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/Virus/mellissa virus.vbs.txt
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.config.deploy
.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.deploy
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\BHAVESH\Documents\Visual Studio 2012\Projects\Bhavesh Virus Maker\Bhavesh Virus Maker\obj\Debug\Bhavesh Virus Maker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 644KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.manifest
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Malware-icon.ico.deploy
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/Bhavesh Virus Maker.application
Bhavesh Virus Maker/Bhavesh Virus Maker/bin/Debug/app.publish/setup.exe
.exe windows:6 windows x86 arch:x86

536ef7dd911b1aa407977b586a8ffe5d

Code Sign

28:56:cf:1a:15:45:d5:b8:40:d4:a1:e6:ee:f2:eb:f1
Certificate

Issuer

CN=101SNIPER\\BHAVESH

Not Before

08-04-2016 03:22

Not After

08-04-2017 09:22

Subject

CN=101SNIPER\\BHAVESH

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15
Signer

Actual PE Digest

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup.pdb

Imports

kernel32

GetCurrentProcessId
OpenProcess
GetNativeSystemInfo
EndUpdateResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
GetTempFileNameW
ReadFile
Sleep
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
GetVersion
GetModuleHandleW
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
MulDiv
GetTickCount
SetEndOfFile
GetExitCodeProcess
LoadLibraryW
SwitchToThread
InterlockedCompareExchange
GetTempPathW
InterlockedExchange
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetEnvironmentVariableA
InitializeCriticalSectionEx
ReadConsoleW
WriteConsoleW
SetStdHandle
HeapReAlloc
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
GetLocaleInfoEx
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
HeapSize
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
RaiseException
LoadLibraryExA
GetCommandLineW
RtlUnwind
InterlockedDecrement
GetCPInfo
HeapFree
SetLastError
InterlockedIncrement
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW

gdi32

GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC

ole32

CoUninitialize
CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA

user32

SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
ScreenToClient
SetCursor
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
GetWindowRect
GetFocus

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW
InternetCombineUrlW

msi

ord8
ord78
ord150
ord92

Exports

Exports

_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/bkHelp.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bkHelp.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bkHelp.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bkMenu.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bkMenu.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bkMenu.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bkUpdate.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/bkUpdate.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/bkUpdate.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/exploitpack.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/exploitpack.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/exploitpack.vb
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/fullscreentext.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/fullscreentext.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/fullscreentext.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.application
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\BHAVESH\Documents\Visual Studio 2012\Projects\Bhavesh Virus Maker\Bhavesh Virus Maker\obj\Debug\Bhavesh Virus Maker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 644KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.exe.manifest
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.pdb
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.vbproj.FileListAbsolute.txt
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.vbproj.GenerateResource.Cache
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh Virus Maker.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.Form1.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.Resources.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.bhAbout.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.bkHelp.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.bkMenu.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.bkUpdate.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.exploitpack.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.fullscreentext.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/Bhavesh_Virus_Maker.welcomemessage.resources
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/DesignTimeResolveAssemblyReferences.cache
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
Bhavesh Virus Maker/Bhavesh Virus Maker/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.application
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.config.deploy
.xml
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.deploy
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\BHAVESH\Documents\Visual Studio 2012\Projects\Bhavesh Virus Maker\Bhavesh Virus Maker\obj\Debug\Bhavesh Virus Maker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 644KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Bhavesh Virus Maker.exe.manifest
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Application Files/Bhavesh Virus Maker_1_0_0_1/Malware-icon.ico.deploy
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/Bhavesh Virus Maker.application
Bhavesh Virus Maker/Bhavesh Virus Maker/publish/setup.exe
.exe windows:6 windows x86 arch:x86

536ef7dd911b1aa407977b586a8ffe5d

Code Sign

28:56:cf:1a:15:45:d5:b8:40:d4:a1:e6:ee:f2:eb:f1
Certificate

Issuer

CN=101SNIPER\\BHAVESH

Not Before

08-04-2016 03:22

Not After

08-04-2017 09:22

Subject

CN=101SNIPER\\BHAVESH

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15
Signer

Actual PE Digest

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup.pdb

Imports

kernel32

GetCurrentProcessId
OpenProcess
GetNativeSystemInfo
EndUpdateResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
GetTempFileNameW
ReadFile
Sleep
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
GetVersion
GetModuleHandleW
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
MulDiv
GetTickCount
SetEndOfFile
GetExitCodeProcess
LoadLibraryW
SwitchToThread
InterlockedCompareExchange
GetTempPathW
InterlockedExchange
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetEnvironmentVariableA
InitializeCriticalSectionEx
ReadConsoleW
WriteConsoleW
SetStdHandle
HeapReAlloc
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
GetLocaleInfoEx
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
HeapSize
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
RaiseException
LoadLibraryExA
GetCommandLineW
RtlUnwind
InterlockedDecrement
GetCPInfo
HeapFree
SetLastError
InterlockedIncrement
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW

gdi32

GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC

ole32

CoUninitialize
CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA

user32

SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
ScreenToClient
SetCursor
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
GetWindowRect
GetFocus

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW
InternetCombineUrlW

msi

ord8
ord78
ord150
ord92

Exports

Exports

_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhavesh Virus Maker/Bhavesh Virus Maker/welcomemessage.Designer.vb
Bhavesh Virus Maker/Bhavesh Virus Maker/welcomemessage.resx
.vbs
Bhavesh Virus Maker/Bhavesh Virus Maker/welcomemessage.vb
Bhavesh Virus Maker/README PLS.txt

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 644KB - Virtual size: 643KB

.sdata Size: 512B - Virtual size: 312B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:02:8e:42:00:00:00:00:00:1fCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

97:f7:fb:00:2c:9c:38:8a:15:ae:14:8f:92:25:0a:ff:c5:74:22:e3:ef:03:94:b5:e5:bc:62:43:20:4e:97:f7Signer

24:92:4f:34:68:12:d8:8d:95:d3:b0:98:0b:0c:33:72:74:92:40:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.sdata Size: 4KB - Virtual size: 168B

.rsrc Size: 168KB - Virtual size: 165KB

.reloc Size: 4KB - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 644KB - Virtual size: 643KB

.sdata Size: 512B - Virtual size: 312B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 512B - Virtual size: 12B

536ef7dd911b1aa407977b586a8ffe5d

Code Sign

28:56:cf:1a:15:45:d5:b8:40:d4:a1:e6:ee:f2:eb:f1Certificate

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

.text
Size: 644KB - Virtual size: 643KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 12B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:8e:42:00:00:00:00:00:1f
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

97:f7:fb:00:2c:9c:38:8a:15:ae:14:8f:92:25:0a:ff:c5:74:22:e3:ef:03:94:b5:e5:bc:62:43:20:4e:97:f7
Signer

24:92:4f:34:68:12:d8:8d:95:d3:b0:98:0b:0c:33:72:74:92:40:15
Signer

.text
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.2MB - Virtual size: 2.2MB

.sdata
Size: 4KB - Virtual size: 168B

.rsrc
Size: 168KB - Virtual size: 165KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 644KB - Virtual size: 643KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 12B

28:56:cf:1a:15:45:d5:b8:40:d4:a1:e6:ee:f2:eb:f1
Certificate

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15
Signer

.text
Size: 310KB - Virtual size: 310KB

.data
Size: 8KB - Virtual size: 17KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 113KB - Virtual size: 113KB

.reloc
Size: 24KB - Virtual size: 24KB

.text
Size: 644KB - Virtual size: 643KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 644KB - Virtual size: 643KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 12B

28:56:cf:1a:15:45:d5:b8:40:d4:a1:e6:ee:f2:eb:f1
Certificate

ab:8d:53:2f:a5:a4:93:5b:b5:5a:c8:81:48:5b:90:42:87:ac:48:15
Signer