virussign[.]com_ebeeb3bad08421173fa290c049c1f590[.]vir

Sharing

Copy URL

Twitter E-mail

General

Target

virussign.com_ebeeb3bad08421173fa290c049c1f590.vir
Size

907KB
MD5

ebeeb3bad08421173fa290c049c1f590
SHA1

b1ef2c575407ec13d44e0c7d8fca944325bc5314
SHA256

fb3feef8894a692e3c91ce00d73f12872b1c39d20980be3a7952e6161f57867c
SHA512

e7c5e2f967cc0289f92ae9478a5dad78242110e71e2bfc39a52cde82ab5792a7c2ae2efe7b20dbaf3d8dbf502b05fa7ba8c8a63e3e1c613fc41707a52fb58178
SSDEEP

12288:LiYdDAklG4EKUTHdUXoXbMBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LJD5lUbdrNSkQ/7Gb8NLEbeZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virussign.com_ebeeb3bad08421173fa290c049c1f590.vir

Files

virussign.com_ebeeb3bad08421173fa290c049c1f590.vir
.exe windows:10 windows x64 arch:x64

702a07ff266ecfbceeac19b4bdb17820

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vshadow.pdb

Imports

kernel32

GetLastError
GetVolumePathNamesForVolumeNameW
WriteFile
CloseHandle
CreateFileW
WideCharToMultiByte
QueryDosDeviceW
GetFileAttributesW
FindFirstFileW
FindClose
FindNextFileW
GetThreadLocale
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
HeapSetInformation
GetExitCodeProcess
LocalFree
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WaitForSingleObject
FormatMessageW
TerminateProcess

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
memcpy
memmove
_errno
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
__uncaught_exception
setlocale
_lock
_unlock
_fsopen
fseek
__pctype_func
isupper
calloc
__iob_func
fputc
memset
islower
__mb_cur_max
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_callnewh
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
strcspn
fputwc
ungetwc
fclose
localeconv
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
_purecall
_vsnwprintf
wprintf
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
malloc
getchar
_wcsnicmp
_wcsicmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
fflush
setvbuf
free
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
sprintf_s
fwrite
memcpy_s
ungetc
fgetc
fgetwc
fgetpos
_fseeki64
fsetpos
_wcsdup

atl

ord30

oleaut32

SysFreeString
SysAllocString

ole32

CLSIDFromString
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal
ShouldBlockRevertInternal

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

resutils

ClusterPrepareSharedVolumeForBackup
ClusterIsPathOnSharedVolume
ClusterGetVolumePathName
ClusterGetVolumeNameForVolumeMountPoint

shlwapi

PathFileExistsW

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

702a07ff266ecfbceeac19b4bdb17820

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

atl

oleaut32

ole32

vssapi

ntdll

resutils

shlwapi

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 119KB - Virtual size: 119KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB