Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_a1628f841ac770973760211ca8010230.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
VirusShare_a1628f841ac770973760211ca8010230.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_a1628f841ac770973760211ca8010230
-
Size
342KB
-
MD5
a1628f841ac770973760211ca8010230
-
SHA1
73a617c3b853fc58f1e7fab73e9c39a3ff5893ca
-
SHA256
381f9c38f54ce9669a5fb3e8a6ee73d7954db19da191c97cb6d0b62d6ff6885a
-
SHA512
de35fe564fc362ebd41c8f49b8123883acf84e41b5efeaabd08834de11e644682f74a15488ca48cbe8a80f22e4966d974fa07a4d7fb97d5832c149aa330db68c
-
SSDEEP
6144:3451UxmbDzQgGWNWveav9I8+dlSkjjI/MnxMBiqZ2NR:M1AwDzQgTN0v9FN+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_a1628f841ac770973760211ca8010230
Files
-
VirusShare_a1628f841ac770973760211ca8010230.exe windows:5 windows x86 arch:x86
eadd3e693e9b1ef37cd94d9f99ed711f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadContext
SetThreadContext
LoadLibraryW
CreateProcessA
GetProcAddress
VirtualAllocEx
GetModuleFileNameA
ResumeThread
GetLastError
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
HeapReAlloc
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW
RaiseException
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 217KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ