rocGetDigInt
Static task
static1
Behavioral task
behavioral1
Sample
virussign.com_e4b87d47ae9b6d41f3c5854cc10fcdc0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
virussign.com_e4b87d47ae9b6d41f3c5854cc10fcdc0.dll
Resource
win10v2004-20240508-en
General
-
Target
virussign.com_e4b87d47ae9b6d41f3c5854cc10fcdc0.vir
-
Size
742KB
-
MD5
e4b87d47ae9b6d41f3c5854cc10fcdc0
-
SHA1
207b4740ce335f4e111ccd4e7c8fbe6095630e7f
-
SHA256
d01815a0d25b5fb131ef3d60e83c9fafb0f21853d08909d1262197695026d059
-
SHA512
f936841315cfbd587c0f0d94e4d7eb36113ffe2ac35d09e4db07eed71a0bcc273bd7a2f14820fc79bcad1056f6ed230021a115087dc40e318398569330f55ad2
-
SSDEEP
6144:9o9OgwdVyZRNEZQCil3jAB2gI5Gj7yxIpMp2xly3yX6Bk5FsAGj+IUEgBJAQxCpV:9o+EjJ/FQixexmw6Bk5FsjWx0R599L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource virussign.com_e4b87d47ae9b6d41f3c5854cc10fcdc0.vir
Files
-
virussign.com_e4b87d47ae9b6d41f3c5854cc10fcdc0.vir.dll windows:4 windows x64 arch:x64
dc3bb7893452ab33bcdd56cc20cc4a64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
advapi32
AdjustTokenPrivileges
GetUserNameA
LookupPrivilegeValueA
OpenProcessToken
iphlpapi
GetAdaptersInfo
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
GetComputerNameA
GetCurrentProcess
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSize
GetLastError
GetSystemTime
GetVersionExA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
OpenEventA
OpenMutexA
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
ResetEvent
SetEvent
SetThreadPriority
Sleep
TerminateThread
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
mpr
WNetGetConnectionA
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
__setusermatherr
_amsg_exit
_beginthread
_chdir
_errno
_fstat64
_getcwd
_getpid
_initterm
_localtime64
_lock
_mktime64
_stat64
_stricmp
_strnicmp
_time64
_unlock
_utime
abort
acos
asin
atan
atof
atoi
atol
calloc
fclose
fflush
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
remove
rename
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtol
system
tan
tolower
toupper
vfprintf
wcslen
_rmdir
_mkdir
_fileno
_fdopen
_access
user32
ExitWindowsEx
ws2_32
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
recvfrom
send
sendto
setsockopt
socket
Exports
Exports
Sections
.text Size: 497KB - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 23KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ