Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_2de1ac3486acc4e72ec5716b129c9302.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
VirusShare_2de1ac3486acc4e72ec5716b129c9302.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_2de1ac3486acc4e72ec5716b129c9302
-
Size
175KB
-
MD5
2de1ac3486acc4e72ec5716b129c9302
-
SHA1
7c76c35d74374a7feafd2552c3625891b041b9a5
-
SHA256
ff9e2f9a5a26e63c6cbb7e03ec4646cb9ad4be1aa7928c109fe9cff9c4c599c4
-
SHA512
8692c32076ab24325f9d6e5cdbff5004d97eab04e422ca159ebb34798fd73f0a2d06aec50a8543097f631acada0233599e1254bd6607a8fb2999ec81d50bbae1
-
SSDEEP
3072:sg9raGUP5w+fDHTN5WPF2njJcTaRPmUPEYzvOMWtPE1mYEhmfDAzkE0+:FaGUdTWPFoSTabPzPWtkGs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_2de1ac3486acc4e72ec5716b129c9302
Files
-
VirusShare_2de1ac3486acc4e72ec5716b129c9302.exe windows:5 windows x86 arch:x86
880ac30a4d6f30502e06197f05ad71bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextChangeNotification
WinExec
HeapFree
SizeofResource
SetFilePointer
GetFileAttributesA
GetFileAttributesExA
GlobalFlags
GetStringTypeExA
FindClose
HeapSetInformation
ResetEvent
GetLocalTime
HeapCreate
RemoveDirectoryA
WritePrivateProfileStringA
CloseHandle
GetModuleHandleW
GetCurrentThread
TlsSetValue
lstrcpynA
GetNumberFormatA
SetEnvironmentVariableA
lstrcatA
CreateEventA
GetCurrentDirectoryW
MulDiv
SystemTimeToFileTime
_lread
GetFileTime
GetConsoleMode
ConvertDefaultLocale
lstrcmpiA
GlobalGetAtomNameA
FindResourceExA
GetCurrentDirectoryA
QueryPerformanceCounter
UnlockFile
LoadLibraryW
GetCommandLineA
GetProcessHeap
GetTimeZoneInformation
GetFullPathNameA
CompareStringA
ReplaceFileA
GetEnvironmentStringsW
RaiseException
WriteConsoleW
GetStringTypeW
GetWindowsDirectoryA
GetSystemTimeAsFileTime
SetEvent
SetFileAttributesA
SetCurrentDirectoryA
SetEndOfFile
GetSystemDirectoryW
EnumResourceTypesA
SetHandleCount
TlsGetValue
GetOEMCP
WideCharToMultiByte
SetUnhandledExceptionFilter
LocalFree
CreateFileA
GetVolumeInformationA
GetPrivateProfileIntA
FindFirstChangeNotificationA
ReadFile
InitializeCriticalSectionAndSpinCount
CompareStringW
DeleteFileA
LoadLibraryExA
DosDateTimeToFileTime
LockFile
GetCurrentThreadId
GetUserDefaultUILanguage
GlobalSize
GetStartupInfoW
OpenFile
GetStdHandle
LoadLibraryA
FileTimeToDosDateTime
MultiByteToWideChar
GetPrivateProfileStringA
FreeResource
GlobalDeleteAtom
lstrlenA
LocalUnlock
GetCurrentProcess
GlobalLock
WriteFile
lstrlenW
CompareFileTime
InitializeCriticalSection
LeaveCriticalSection
CreateFileMappingA
Sleep
GetTempFileNameA
GetSystemInfo
LocalFileTimeToFileTime
InterlockedIncrement
IsValidCodePage
GetLocaleInfoA
GetSystemDirectoryA
HeapSize
FindFirstFileA
ExpandEnvironmentStringsA
GetCurrentProcessId
GetThreadLocale
GlobalFree
GetDriveTypeA
GetModuleFileNameW
FlushFileBuffers
GetTempPathA
LCMapStringW
SearchPathA
_lwrite
GlobalReAlloc
GetProfileIntA
GetUserDefaultLangID
SetErrorMode
DuplicateHandle
FileTimeToLocalFileTime
LocalAlloc
LocalLock
GlobalAddAtomA
CopyFileA
TlsAlloc
GetModuleHandleA
FreeLibrary
IsDebuggerPresent
FindCloseChangeNotification
VirtualProtect
SetFileTime
_lcreat
GetDiskFreeSpaceA
FreeEnvironmentStringsW
FindFirstFileExA
CreateThread
MapViewOfFile
EnumResourceLanguagesA
LoadResource
GlobalAlloc
DeleteCriticalSection
TlsFree
WaitForMultipleObjects
EnumResourceNamesA
GetFileSizeEx
GetACP
GlobalHandle
SuspendThread
SetLastError
LocalReAlloc
InterlockedDecrement
GetModuleFileNameA
lstrcmpW
GetFileType
FindResourceExW
GetProcAddress
FindNextFileA
FormatMessageA
GetEnvironmentVariableW
LoadLibraryExW
CancelWaitableTimer
VirtualProtectEx
AddAtomW
CancelIo
GetVersion
GlobalAddAtomW
AreFileApisANSI
GlobalFindAtomA
HeapQueryInformation
lstrcpyA
InterlockedExchange
FindResourceW
UnhandledExceptionFilter
HeapReAlloc
GetFileSize
HeapAlloc
GetFileInformationByHandle
CreateDirectoryA
ResumeThread
IsProcessorFeaturePresent
GetConsoleCP
CreateProcessA
GetLastError
lstrcmpA
GetCPInfo
EnterCriticalSection
LockResource
SetThreadPriority
GetVersionExA
SetPriorityClass
TerminateProcess
WaitForSingleObject
FileTimeToSystemTime
GetDriveTypeW
SetStdHandle
RtlUnwind
GetShortPathNameA
CreateFileW
GetSystemDefaultUILanguage
_lclose
MoveFileA
FindResourceA
GlobalUnlock
QueryPerformanceFrequency
user32
LoadStringA
LoadIconA
CharUpperA
wsprintfW
GetDesktopWindow
IsWindowVisible
SetForegroundWindow
advapi32
QueryServiceStatusEx
RegEnumKeyW
RegCreateKeyW
CreateServiceW
StartServiceCtrlDispatcherW
OpenProcessToken
DeleteService
SetNamedSecurityInfoW
StartServiceW
CloseServiceHandle
ControlService
OpenServiceW
RegSetValueExW
RegOpenKeyExW
SetEntriesInAclW
ChangeServiceConfigW
SetServiceStatus
SetTokenInformation
RevertToSelf
RegCloseKey
OpenSCManagerW
EnumDependentServicesW
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
CreateProcessAsUserW
BuildExplicitAccessWithNameW
DuplicateTokenEx
ReportEventW
RegCreateKeyExW
RegQueryValueExW
GetNamedSecurityInfoW
DeregisterEventSource
RegOpenKeyW
GetTokenInformation
shell32
SHGetMalloc
SHEmptyRecycleBinW
SHGetSpecialFolderPathW
ole32
CoInitialize
shlwapi
StrStrIW
PathFindFileNameW
PathAppendW
PathQuoteSpacesW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
version
VerQueryValueW
oledlg
ord8
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
psapi
GetModuleInformation
GetModuleFileNameExW
msvcrt
_except_handler3
_exit
__set_app_type
exit
_CIsin
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ