virussign[.]com_1cef154ecf77e3eab7c67a22336f8ee0[.]vir | Triage

Sharing

Copy URL Twitter E-mail

General

Target

virussign.com_1cef154ecf77e3eab7c67a22336f8ee0.vir
Size

35KB
MD5

1cef154ecf77e3eab7c67a22336f8ee0
SHA1

4ace8d2ce862d7a6de4daecabae1aed1d95b8302
SHA256

5c35e9fa6826307883c61b157fa5653d83658b3af979d958f9b3baa4d9c6e0ee
SHA512

f6eea98517392b3b8c410433afd9ffea95d1b43b6b048b1cee29ef7661c299f266ec2939ce77956e6be9024fb32d7ec6de57c38c15e869f974ac22078ba8cddd
SSDEEP

768:3BK7SObZyWZsG8K5jIIRlHDu5EWJeiw487982DL2T:x+SObfZsGbjNRuJZob+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virussign.com_1cef154ecf77e3eab7c67a22336f8ee0.vir

Files

virussign.com_1cef154ecf77e3eab7c67a22336f8ee0.vir
.exe windows:5 windows x86 arch:x86

c6252fccf829b9d03821f28adaf32c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_except_handler3
_initterm
__getmainargs
__initenv
exit
_write
_cexit
_XcptFilter
__setusermatherr
_exit
_c_exit

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyA
GetUserNameA
RegCloseKey

kernel32

GetTickCount
FormatMessageA
LocalFree
GetComputerNameA
GetFileSize
_lclose
GetModuleHandleA
OpenFile
_lread

lprhelp

WriteJobData
StartJob
InitiateConnection
CloseLPR
CancelJob
OpenLPR
EndJob

user32

CharToOemBuffA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE