Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_2c5af633baaf40983e9123ca4823cffc.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
VirusShare_2c5af633baaf40983e9123ca4823cffc.exe
Resource
win10v2004-20240426-en
General
-
Target
VirusShare_2c5af633baaf40983e9123ca4823cffc
-
Size
151KB
-
MD5
2c5af633baaf40983e9123ca4823cffc
-
SHA1
da96ac110ab15843f18ad0512493c57e028b6b54
-
SHA256
f44569d7e844e832a406737f306b1df86f939b0abcf69cc3dffda859849c1a40
-
SHA512
673800942ff846b937dcfd179bace32f3329261e1738c2bc464320c007570c8ae0b852dd2351f56880f1f43b2354054bba4961e1dfa84b3a5394ffee602ea157
-
SSDEEP
3072:bam+1KvgXGtXlcJlbMBF+6BmQHKz7ITUj929uFg7:b9yKIWt1DB9W74ksQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_2c5af633baaf40983e9123ca4823cffc
Files
-
VirusShare_2c5af633baaf40983e9123ca4823cffc.exe windows:5 windows x86 arch:x86
a5452a8a020e420f84422d7c4fb1e4b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExpandEnvironmentStringsA
DosDateTimeToFileTime
Sleep
IsDebuggerPresent
CreateFileW
lstrcpynA
GetProcessHeap
GlobalDeleteAtom
GlobalUnlock
GlobalHandle
GetVolumeInformationA
lstrcmpA
DeleteCriticalSection
CloseHandle
GetConsoleMode
GetCommandLineA
FlushFileBuffers
WideCharToMultiByte
GetEnvironmentStringsW
SetFileTime
OpenFile
GetDiskFreeSpaceA
GetFullPathNameA
SetStdHandle
SetLastError
UnhandledExceptionFilter
InterlockedDecrement
GetModuleFileNameA
FindResourceA
QueryPerformanceFrequency
MapViewOfFile
GetShortPathNameA
GetModuleFileNameW
TlsFree
LocalFree
WriteFile
LocalAlloc
SetHandleCount
GetCurrentDirectoryA
GetTimeZoneInformation
MoveFileA
WriteConsoleW
LoadLibraryA
CompareFileTime
GetDriveTypeW
CreateEventA
MultiByteToWideChar
WaitForSingleObject
LockResource
RaiseException
HeapCreate
EnumResourceLanguagesA
GetLocaleInfoA
GetCurrentDirectoryW
CreateThread
GetSystemInfo
EnterCriticalSection
SetThreadPriority
GlobalLock
HeapSize
FindNextChangeNotification
GetPrivateProfileIntA
SystemTimeToFileTime
LocalUnlock
SetErrorMode
GetNumberFormatA
CreateFileA
GetProcAddress
GlobalFindAtomA
TlsGetValue
FindFirstChangeNotificationA
GetStringTypeExA
SetFilePointer
FreeEnvironmentStringsW
GetStdHandle
GetVersionExA
WinExec
GetLocalTime
GetFileSizeEx
GetCurrentThread
CreateFileMappingA
FindResourceExA
InterlockedExchange
ResumeThread
CompareStringW
FreeLibrary
FindResourceW
lstrcmpiA
GetOEMCP
FindCloseChangeNotification
GetUserDefaultLangID
DeleteFileA
WritePrivateProfileStringA
lstrcatA
GlobalFlags
GlobalAddAtomA
LocalFileTimeToFileTime
QueryPerformanceCounter
LoadLibraryW
GetStringTypeW
LoadLibraryExA
SizeofResource
LoadResource
GetWindowsDirectoryA
GetFileTime
LockFile
GetConsoleCP
GetSystemDefaultUILanguage
CreateDirectoryA
GetSystemDirectoryW
TlsAlloc
ResetEvent
RtlUnwind
GetDriveTypeA
lstrcmpW
GlobalFree
GetFileAttributesA
TerminateProcess
HeapFree
GetCurrentProcess
ConvertDefaultLocale
IsValidCodePage
MulDiv
GetUserDefaultUILanguage
UnlockFile
lstrcpyA
WaitForMultipleObjects
SetEnvironmentVariableA
SearchPathA
GetFileAttributesExA
LCMapStringW
LocalReAlloc
FileTimeToSystemTime
GlobalSize
GetStartupInfoW
GetSystemTimeAsFileTime
lstrlenA
GetTempFileNameA
FreeResource
SetUnhandledExceptionFilter
GetPrivateProfileStringA
GetCurrentProcessId
GetProfileIntA
HeapAlloc
FileTimeToDosDateTime
CreateProcessA
SetCurrentDirectoryA
GlobalGetAtomNameA
GetThreadLocale
CopyFileA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
GetCPInfo
LeaveCriticalSection
SuspendThread
IsProcessorFeaturePresent
lstrlenW
InterlockedIncrement
GetLastError
GetFileType
GetTempPathA
FileTimeToLocalFileTime
GetCurrentThreadId
SetFileAttributesA
SetEvent
GlobalReAlloc
SetEndOfFile
GetFileInformationByHandle
GetFileSize
DuplicateHandle
CompareStringA
GetACP
FindResourceExW
HeapSetInformation
TlsSetValue
SetPriorityClass
LocalLock
VirtualProtect
GetModuleHandleA
GlobalFindAtomW
FindAtomA
GetTickCount
HeapQueryInformation
user32
PostMessageW
PostQuitMessage
GetWindowTextW
KillTimer
IsWindow
SetFocus
EnumChildWindows
GetWindow
SendMessageW
LoadMenuW
GetWindowThreadProcessId
DrawTextW
MonitorFromPoint
SetWindowLongW
GetMonitorInfoW
GetWindowRect
TranslateMessage
GetClientRect
GetWindowLongW
ReleaseDC
DispatchMessageW
LoadImageW
TrackPopupMenuEx
MonitorFromWindow
SetWindowTextW
GetWindowDC
CallWindowProcW
GetCursorPos
SetTimer
GetMenuItemInfoW
AppendMenuW
SetCursor
PeekMessageW
GetMessageW
RemoveMenu
GetMenuItemCount
DestroyMenu
UnregisterClassA
InvalidateRect
EnumWindows
CreatePopupMenu
GetFocus
DestroyCursor
SetWindowPos
DestroyWindow
LoadStringA
LoadIconA
IsWindowEnabled
CharLowerW
GetForegroundWindow
GetKeyboardLayout
IsWindowVisible
EnableWindow
ScreenToClient
LoadCursorW
DefWindowProcW
TrackMouseEvent
ShowWindow
GetClassNameW
MapWindowPoints
CharNextW
GetParent
PtInRect
TranslateAcceleratorW
MessageBeep
UpdateLayeredWindow
LoadStringW
gdi32
CloseFigure
BeginPath
AddFontMemResourceEx
advapi32
SetTokenInformation
CreateServiceW
OpenServiceW
RegisterEventSourceW
RegOpenKeyA
SetNamedSecurityInfoW
RegQueryValueExW
DeleteService
CreateProcessAsUserW
RegisterServiceCtrlHandlerExW
ChangeServiceConfigW
BuildExplicitAccessWithNameW
DeregisterEventSource
GetNamedSecurityInfoW
RegOpenKeyExW
RegCreateKeyW
StartServiceCtrlDispatcherW
EnumDependentServicesW
ReportEventW
QueryServiceStatusEx
RegCreateKeyExW
DuplicateTokenEx
SetServiceStatus
RegEnumKeyW
SetEntriesInAclW
RegCloseKey
RevertToSelf
OpenSCManagerW
RegSetValueExW
GetTokenInformation
ControlService
OpenProcessToken
StartServiceW
CloseServiceHandle
shell32
SHEmptyRecycleBinW
SHGetSpecialFolderPathW
ole32
CoInitialize
shlwapi
PathFindFileNameW
PathCombineW
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathAppendW
PathQuoteSpacesW
version
VerQueryValueW
oledlg
OleUIBusyW
ord8
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
psapi
GetModuleFileNameExW
GetModuleInformation
msvcrt
_CIsin
_CIcos
exit
_except_handler3
free
malloc
__set_app_type
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data5 Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ