virussign[.]com_62939b3fe3812c5c235cadd471a93290[.]vir | Triage

Sharing

Copy URL Twitter E-mail

General

Target

virussign.com_62939b3fe3812c5c235cadd471a93290.vir
Size

201KB
MD5

62939b3fe3812c5c235cadd471a93290
SHA1

993e4646111808eef7e92920f58cf0deaf23ba4a
SHA256

527f772b0acd046d728ed0995cfbbe238357d76ae08083395e2c2fbfc8f29d42
SHA512

46473eb242e72b7ec893f8a78e4af953154515066346201793a4ad606ebffaef171ddd1707d96f1920f2867a588cd8779c2df17a4cfc266062470d57ded9fb40
SSDEEP

6144:WvVNKTWduZn4HXfDHHjpWVncWYSlYhluu/QtPa:WjgPZ4HvrHj436/Ia

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virussign.com_62939b3fe3812c5c235cadd471a93290.vir

Files

virussign.com_62939b3fe3812c5c235cadd471a93290.vir
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\PMS\pms4\Project(20130920)\HanCapture_2005\bin\HanCapture_2005.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 172KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE