VirusShare_fec35d33c62d598c6072cf842000e6c5

Sharing

Copy URL

Twitter E-mail

General

Target

VirusShare_fec35d33c62d598c6072cf842000e6c5
Size

322KB
MD5

fec35d33c62d598c6072cf842000e6c5
SHA1

65ec1029df2fe3a32a8a5b5cc582e63dd31b678f
SHA256

92c99a9aee4690a4124d8e3d62b2d5a3bf6b81cbf5e37c33b48fe5cbfbab1808
SHA512

a654aee3ebe6da60461329f6da2ad8e16960cee259b1630d477094e57ee346a6eb971937334c290ba6b70eb76d946ab6ffce28a5b7fc4aa2b9754509ec36c325
SSDEEP

6144:19tJvFwH6WBBLVyET1Pm00c/aWkC7/ssyv5mREW26:1xFwHBBVPm7QaWkCA5+nP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VirusShare_fec35d33c62d598c6072cf842000e6c5

Files

VirusShare_fec35d33c62d598c6072cf842000e6c5
.exe windows:4 windows x86 arch:x86

c0a7488080e25e7fecdac00872ea23bb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetProviderNameA
WNetGetUserA
WNetCancelConnection2A
WNetGetConnectionA
WNetAddConnection2A
WNetAddConnectionW
WNetConnectionDialog1A
WNetGetUniversalNameW
WNetCancelConnectionW
WNetOpenEnumW
MultinetGetConnectionPerformanceW
MultinetGetConnectionPerformanceA
WNetGetLastErrorW
WNetEnumResourceA
WNetConnectionDialog1W
WNetGetNetworkInformationA
WNetAddConnectionA
WNetAddConnection3A
WNetGetLastErrorA
WNetGetConnectionW
WNetAddConnection3W
WNetCancelConnectionA
WNetGetUniversalNameA
WNetCloseEnum

msvcrt

_exit
_XcptFilter
exit
_acmdln
__getmainargs
__set_app_type
_except_handler3
_controlfp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__p__fmode

gdi32

GetBoundsRect
SetDIBitsToDevice
CreateDIBPatternBrushPt
CreateDIBPatternBrush
UpdateColors
Polygon
FixBrushOrgEx
GetCharWidth32A
GetMetaFileA
GetBrushOrgEx
OffsetRgn
CreateRectRgnIndirect

user32

DestroyCaret
GetMenuContextHelpId
EmptyClipboard
GetWindowPlacement
SetMenuItemInfoA
TranslateAcceleratorA
GetScrollRange
CheckMenuItem
GetKeyboardLayoutNameA
ActivateKeyboardLayout
OemToCharBuffA
TranslateMessage
GetProcessWindowStation
GetMenuStringW
DdeKeepStringHandle
GetTopWindow
GetUpdateRect
SetRectEmpty
GetPropW
GetMenuStringA
GetMessageA
GetMenuItemID
CloseDesktop
CharToOemBuffW
LookupIconIdFromDirectoryEx
SetKeyboardState
LoadCursorFromFileW
GetTabbedTextExtentW
IsWindow
ReleaseDC
SetMenu
GetClassWord
CreateMenu
GetSysColor
FrameRect
IsRectEmpty
GetKeyState
IsDialogMessageA
CheckRadioButton
MessageBoxExA
CallMsgFilterA
DrawTextExA
GetNextDlgGroupItem
GetWindowRect
ToUnicodeEx
ReuseDDElParam
MenuItemFromPoint
DrawStateW
CloseWindowStation
CallWindowProcA
DrawTextExW
IsIconic
DrawEdge
SwitchDesktop
SetDlgItemTextW
InsertMenuItemA
DrawTextW
SetWinEventHook
GetClassInfoExA
InvertRect
DialogBoxParamA
ModifyMenuA
SetCursorPos
GetDlgItemTextA
LoadMenuW
SetWindowTextW
ShowWindowAsync
RegisterClassExW
InvalidateRgn
DdeConnect
SetWindowContextHelpId
ChangeDisplaySettingsExA
GetWindowDC
GetWindowTextLengthA
InflateRect
CharLowerBuffW
DrawMenuBar
SetWindowRgn
MapVirtualKeyW
SetClassLongW
CreateDialogParamW
GetMenu
EnumWindows
CloseWindow
GetMenuCheckMarkDimensions
SendMessageA
GetCapture
GetClipboardFormatNameW
IsZoomed
CopyAcceleratorTableA
NotifyWinEvent
GetCaretPos
SetCursor
FlashWindow
GetKeyboardLayout
GetDlgItemInt
ToAscii
SetMenuDefaultItem
ChildWindowFromPointEx
PeekMessageW
DispatchMessageW
EnumDesktopsW
CreateCaret
GetInputState
GetGUIThreadInfo
OpenDesktopW
DdeSetQualityOfService
EnumWindowStationsW
GetWindowLongA

pdh

PdhParseInstanceNameA

winspool.drv

AddPrinterDriverExA
AddJobA

advapi32

FreeSid
GetKernelObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
BuildImpersonateExplicitAccessWithNameA
CopySid
GetSecurityInfo
EqualSid
RegEnumKeyExW
ObjectOpenAuditAlarmW
AbortSystemShutdownW
LsaFreeMemory
LsaClose
OpenEventLogA
RegSetValueExW
GetSecurityDescriptorLength
ObjectPrivilegeAuditAlarmA
SetEntriesInAclW
OpenProcessToken
SetSecurityDescriptorDacl
RegisterEventSourceW
RegCreateKeyExA
GetAce
LookupSecurityDescriptorPartsW
GetMultipleTrusteeW
AllocateLocallyUniqueId
LookupPrivilegeNameW
AdjustTokenPrivileges
LsaLookupNames
ImpersonateLoggedOnUser
GetNumberOfEventLogRecords
DecryptFileW
RegQueryValueExW
MapGenericMask
SetSecurityDescriptorGroup
AddAce
InitiateSystemShutdownW
RegEnumKeyA
OpenServiceA
LsaEnumerateAccountsWithUserRight
AreAnyAccessesGranted
DuplicateTokenEx
MakeAbsoluteSD
RegDeleteValueW
GetNamedSecurityInfoA
GetTokenInformation
LsaEnumerateAccountRights
SetThreadToken
LsaSetDomainInformationPolicy
EnumServicesStatusA
OpenSCManagerW
SetKernelObjectSecurity
BuildImpersonateTrusteeA
GetExplicitEntriesFromAclA
LogonUserW
LookupPrivilegeDisplayNameW
CreateRestrictedToken
RegQueryValueW
GetTrusteeTypeA
ReportEventA
RegUnLoadKeyW
RegCreateKeyExW
QueryServiceConfig2A
LsaOpenPolicy
GetTrusteeFormA
CloseEventLog
LsaNtStatusToWinError
GetFileSecurityW
LookupPrivilegeValueA
IsTextUnicode
SetEntriesInAclA
BuildTrusteeWithNameW
RegisterServiceCtrlHandlerW
RegSetValueExA
RegOpenKeyA
OpenBackupEventLogW
GetFileSecurityA
GetServiceKeyNameW
LsaSetInformationPolicy
BuildTrusteeWithNameA
LsaCreateTrustedDomainEx
GetSecurityDescriptorDacl
RegDeleteKeyW
GetAclInformation
RegDeleteValueA
RegCreateKeyW
GetMultipleTrusteeA
OpenBackupEventLogA
LookupPrivilegeNameA
StartServiceCtrlDispatcherW
LsaEnumerateTrustedDomains
InitiateSystemShutdownA
SetServiceStatus
AddAccessDeniedAce
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
LsaRetrievePrivateData
LsaSetTrustedDomainInfoByName
RevertToSelf
QueryServiceConfig2W
LookupPrivilegeValueW
IsTokenRestricted
QueryServiceLockStatusW
LsaQueryTrustedDomainInfo
ObjectCloseAuditAlarmA
EqualPrefixSid
ClearEventLogW
RegCreateKeyA
SetServiceObjectSecurity
RegUnLoadKeyA
RegOverridePredefKey
RegQueryValueA
ChangeServiceConfigW
ObjectDeleteAuditAlarmW
GetServiceDisplayNameW
GetAuditedPermissionsFromAclW
FindFirstFreeAce
GetTrusteeFormW
RegSetKeySecurity
GetSecurityDescriptorGroup
BackupEventLogA

shlwapi

PathIsDirectoryW
PathMakePrettyW
PathIsUNCServerA
PathIsSameRootW
PathCommonPrefixW
SHDeleteKeyA
SHRegGetUSValueW
PathCompactPathExW
PathMatchSpecW
PathRemoveArgsW
SHEnumKeyExA
PathRemoveArgsA
SHSetValueW
PathIsRootA
PathIsUNCServerW
SHDeleteValueW
SHRegQueryUSValueA
SHRegSetUSValueA

version

GetFileVersionInfoW
VerQueryValueA

imm32

ImmSetStatusWindowPos
ImmEscapeW
ImmGetIMEFileNameA
ImmDestroyContext
ImmGetCompositionStringW
ImmCreateContext
ImmConfigureIMEA
ImmNotifyIME
ImmRegisterWordA
ImmConfigureIMEW
ImmGetDescriptionA
ImmGetRegisterWordStyleW
ImmSetCompositionWindow
ImmGetCompositionFontA
ImmEnumRegisterWordA
ImmSetCompositionStringA
ImmIsIME
ImmGetOpenStatus
ImmGetCandidateListW
ImmIsUIMessageA
ImmEnumRegisterWordW
ImmGetCompositionWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmAssociateContext
ImmGetGuideLineA
ImmRegisterWordW
ImmReleaseContext
ImmGetCompositionStringA
ImmSetConversionStatus
ImmGetContext
ImmGetIMEFileNameW
ImmGetDescriptionW
ImmUnregisterWordW
ImmSetOpenStatus
ImmGetCompositionFontW

kernel32

HeapReAlloc
BuildCommDCBA
ConnectNamedPipe
CreateFileMappingA
CreateMutexA
GetCurrencyFormatW
EnumTimeFormatsW
GetModuleHandleA
GetStartupInfoA

winmm

midiInAddBuffer
mmioRenameA
sndPlaySoundA
waveOutGetPitch
mmioDescend
auxGetNumDevs
waveInGetID
mmioStringToFOURCCA
mmioRenameW
mmioInstallIOProcW
midiOutMessage
joyGetThreshold
mciGetDeviceIDW
midiInPrepareHeader
waveInReset
mciGetErrorStringA
midiInReset
mixerGetControlDetailsW
mixerClose
mciGetErrorStringW
midiOutClose
mixerGetLineControlsW
GetDriverModuleHandle
mciGetDeviceIDA
mixerSetControlDetails
waveInGetDevCapsW
midiOutSetVolume
mmioStringToFOURCCW
mmioInstallIOProcA
waveOutGetErrorTextW
mixerGetControlDetailsA
timeBeginPeriod
midiInGetErrorTextW
timeGetTime
mciGetYieldProc
midiStreamProperty
midiOutGetErrorTextW
joyGetDevCapsA
mciSendStringW
midiConnect
mmioSetBuffer
waveInStop
waveInPrepareHeader
midiOutPrepareHeader
mciSendCommandW
SendDriverMessage
waveInGetPosition
midiOutGetErrorTextA
mmioRead
mmioAscend
joyGetPosEx
mmioSetInfo
midiOutGetID
auxSetVolume
mmioOpenA
midiOutGetDevCapsW
mixerGetLineInfoA
midiInUnprepareHeader
CloseDriver
midiInGetDevCapsA
mciGetDeviceIDFromElementIDW
waveInStart
midiInGetNumDevs
midiInStart
waveInClose
mixerGetDevCapsA
waveInGetErrorTextW
waveOutSetVolume
PlaySoundA
joySetThreshold
waveOutGetPlaybackRate
midiOutGetNumDevs
mixerGetDevCapsW
OpenDriver
midiStreamOut
mmioAdvance
waveOutBreakLoop
DrvGetModuleHandle
midiInStop
mciSendCommandA
waveOutOpen
DefDriverProc
mmioClose
waveOutGetVolume
midiInGetErrorTextA
waveInGetDevCapsA

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0a7488080e25e7fecdac00872ea23bb

Headers

File Characteristics

Imports

mpr

msvcrt

gdi32

user32

pdh

winspool.drv

advapi32

shlwapi

version

imm32

kernel32

winmm

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 2.5MB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 2.5MB

.rsrc
Size: 20KB - Virtual size: 19KB