virussign[.]com_89610a145ab61d5eb5265bc060974560[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

virussign.com_89610a145ab61d5eb5265bc060974560.vir
Size

491KB
MD5

89610a145ab61d5eb5265bc060974560
SHA1

86af3153012fb44ab932b46ddcb7c53140558f70
SHA256

760a2f2e2bb4ca2bcd54b8ed6d02f804343bcb6daa7d9b4a05bfb306a51d339b
SHA512

f157c7769d934c6cfc4c22010308ce2f0d68ec1be4121df59e9c76d2496ec99a101478c99f1918043419367e653b3f493e5d10fc8979531f32c1d43f48553dbd
SSDEEP

12288:6huX1Emuka88oGf86sqGoE/FRD80sFo/so:6+1pa8ZGf86sqGoPEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virussign.com_89610a145ab61d5eb5265bc060974560.vir

Files

virussign.com_89610a145ab61d5eb5265bc060974560.vir
.dll windows:6 windows x64 arch:x64

dcfb430b2f2d02e59b8a824be34ff902

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

zlib1

inflateInit_
inflateInit2_
zlibVersion
inflate
inflateEnd

nghttp2

nghttp2_session_del
nghttp2_session_send
nghttp2_session_mem_recv
nghttp2_session_callbacks_set_on_frame_recv_callback
nghttp2_session_resume_data
nghttp2_session_callbacks_new
nghttp2_session_want_write
nghttp2_session_callbacks_set_on_data_chunk_recv_callback
nghttp2_session_get_stream_user_data
nghttp2_session_set_stream_user_data
nghttp2_session_callbacks_set_error_callback
nghttp2_session_client_new
nghttp2_session_callbacks_set_on_stream_close_callback
nghttp2_session_callbacks_set_on_begin_headers_callback
nghttp2_session_get_stream_remote_window_size
nghttp2_session_get_remote_window_size
nghttp2_session_want_read
nghttp2_session_get_remote_settings
nghttp2_session_upgrade2
nghttp2_pack_settings_payload
nghttp2_strerror
nghttp2_http2_strerror
nghttp2_priority_spec_init
nghttp2_submit_request
nghttp2_submit_priority
nghttp2_submit_rst_stream
nghttp2_submit_settings
nghttp2_submit_ping
nghttp2_session_check_request_allowed
nghttp2_session_set_local_window_size
nghttp2_session_callbacks_set_send_callback
nghttp2_version
nghttp2_is_fatal
nghttp2_session_callbacks_set_on_header_callback
nghttp2_session_callbacks_del

ws2_32

WSAEnumNetworkEvents
WSAResetEvent
WSACloseEvent
listen
accept
gethostname
freeaddrinfo
getaddrinfo
WSAIoctl
WSASetLastError
socket
setsockopt
recv
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
WSASetEvent
send
closesocket
WSAWaitForMultipleEvents
ioctlsocket
__WSAFDIsSet
select
htonl
WSAStartup
WSACleanup
WSAEventSelect
recvfrom
WSACreateEvent
sendto

wldap32

ord27
ord32
ord22
ord35
ord79
ord30
ord200
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord143
ord26
ord33
ord217

advapi32

CryptAcquireContextA
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom
CryptReleaseContext

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
FreeLibrary
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
MultiByteToWideChar
SleepEx
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
CloseHandle
WaitForSingleObjectEx
GetEnvironmentVariableA
Sleep
MoveFileExA
GetLastError
SetLastError
FormatMessageW
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
GetStdHandle
GetFileType
PeekNamedPipe
ReadFile
WaitForMultipleObjects
QueryPerformanceCounter
GetTickCount
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
RtlCaptureContext
TerminateProcess
DeleteCriticalSection
RtlLookupFunctionEntry

vcruntime140

__C_specific_handler
memcpy
memchr
memset
strchr
strrchr
memmove
memcmp
strstr
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

_close
_read
fwrite
fflush
__stdio_common_vsprintf
fputc
feof
fclose
fputs
__stdio_common_vsscanf
fseek
fread
ftell
_lseeki64
_write
__acrt_iob_func
_open
fgets
fopen

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtol
strtoll
wcstombs

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_getpid
__sys_errlist
__sys_nerr
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_errno

api-ms-win-crt-string-l1-1-0

isupper
strspn
strcspn
_strdup
strncpy
strcmp
tolower
strpbrk
strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_access
_unlink

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
calloc

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info

Sections

.text
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcfb430b2f2d02e59b8a824be34ff902

Headers

DLL Characteristics

File Characteristics

Imports

zlib1

nghttp2

ws2_32

wldap32

advapi32

crypt32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 366KB - Virtual size: 366KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 8KB - Virtual size: 9KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 366KB - Virtual size: 366KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 8KB - Virtual size: 9KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB