Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_0df792234f673b6c47e1d5bab1c24c79.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_0df792234f673b6c47e1d5bab1c24c79.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_0df792234f673b6c47e1d5bab1c24c79
-
Size
175KB
-
MD5
0df792234f673b6c47e1d5bab1c24c79
-
SHA1
70fa9129ba7612d9810f4664cca6569f2ef1d712
-
SHA256
211872287bc99de82ff6c1c9c4b5e8733d3b236385ce5e915ee0e3ddbf2dac80
-
SHA512
0f16a656b5c8028cf36ca7cec2e12431c08f4d3465d1940d1fd7e6c8eb919638118b42c99d0d68c20a02a23d10e64472f2c9a1dfddce5f7a77b7ea95e58ff363
-
SSDEEP
3072:tQiXFjFF5+RRKYkQHd2b3+CjJUTNrbP67BXwk9UnwTfhT1zyK2W85k4u4d0ku:tQiXTF0+QHd2xjYNwgk9UncT1zyKbQk8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_0df792234f673b6c47e1d5bab1c24c79
Files
-
VirusShare_0df792234f673b6c47e1d5bab1c24c79.exe windows:5 windows x86 arch:x86
42078402357ce17a7b8d59c64995b229
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextChangeNotification
WinExec
HeapFree
SizeofResource
SetFilePointer
GetFileAttributesA
GetFileAttributesExA
GlobalFlags
GetStringTypeExA
FindClose
HeapSetInformation
ResetEvent
GetLocalTime
HeapCreate
RemoveDirectoryA
WritePrivateProfileStringA
CloseHandle
GetModuleHandleW
GetCurrentThread
TlsSetValue
lstrcpynA
GetNumberFormatA
SetEnvironmentVariableA
lstrcatA
CreateEventA
GetCurrentDirectoryW
MulDiv
SystemTimeToFileTime
_lread
GetFileTime
GetConsoleMode
ConvertDefaultLocale
lstrcmpiA
GlobalGetAtomNameA
FindResourceExA
GetCurrentDirectoryA
QueryPerformanceCounter
UnlockFile
LoadLibraryW
GetCommandLineA
GetProcessHeap
GetTimeZoneInformation
GetFullPathNameA
CompareStringA
ReplaceFileA
GetEnvironmentStringsW
RaiseException
WriteConsoleW
GetStringTypeW
GetWindowsDirectoryA
GetSystemTimeAsFileTime
SetEvent
SetFileAttributesA
SetCurrentDirectoryA
SetEndOfFile
GetSystemDirectoryW
EnumResourceTypesA
SetHandleCount
TlsGetValue
GetOEMCP
WideCharToMultiByte
SetUnhandledExceptionFilter
LocalFree
CreateFileA
GetVolumeInformationA
GetPrivateProfileIntA
FindFirstChangeNotificationA
ReadFile
InitializeCriticalSectionAndSpinCount
CompareStringW
DeleteFileA
LoadLibraryExA
DosDateTimeToFileTime
LockFile
GetCurrentThreadId
GetUserDefaultUILanguage
GlobalSize
GetStartupInfoW
OpenFile
GetStdHandle
LoadLibraryA
FileTimeToDosDateTime
MultiByteToWideChar
GetPrivateProfileStringA
FreeResource
GlobalDeleteAtom
lstrlenA
LocalUnlock
GetCurrentProcess
GlobalLock
WriteFile
lstrlenW
CompareFileTime
InitializeCriticalSection
LeaveCriticalSection
CreateFileMappingA
Sleep
GetTempFileNameA
GetSystemInfo
LocalFileTimeToFileTime
InterlockedIncrement
IsValidCodePage
GetLocaleInfoA
GetSystemDirectoryA
HeapSize
FindFirstFileA
ExpandEnvironmentStringsA
GetCurrentProcessId
GetThreadLocale
GlobalFree
GetDriveTypeA
GetModuleFileNameW
FlushFileBuffers
GetTempPathA
LCMapStringW
SearchPathA
_lwrite
GlobalReAlloc
GetProfileIntA
GetUserDefaultLangID
SetErrorMode
DuplicateHandle
FileTimeToLocalFileTime
LocalAlloc
LocalLock
GlobalAddAtomA
CopyFileA
TlsAlloc
GetModuleHandleA
FreeLibrary
IsDebuggerPresent
FindCloseChangeNotification
VirtualProtect
SetFileTime
_lcreat
GetDiskFreeSpaceA
FreeEnvironmentStringsW
FindFirstFileExA
CreateThread
MapViewOfFile
EnumResourceLanguagesA
LoadResource
GlobalAlloc
DeleteCriticalSection
TlsFree
WaitForMultipleObjects
EnumResourceNamesA
GetFileSizeEx
GetACP
GlobalHandle
SuspendThread
SetLastError
LocalReAlloc
InterlockedDecrement
GetModuleFileNameA
lstrcmpW
GetFileType
FindResourceExW
GetProcAddress
FindNextFileA
FormatMessageA
GetEnvironmentVariableW
LoadLibraryExW
VirtualProtectEx
OpenWaitableTimerA
OpenWaitableTimerW
AddAtomW
CancelIo
GetVersion
GlobalAddAtomW
AreFileApisANSI
GlobalFindAtomA
HeapQueryInformation
lstrcpyA
InterlockedExchange
FindResourceW
UnhandledExceptionFilter
HeapReAlloc
GetFileSize
HeapAlloc
GetFileInformationByHandle
CreateDirectoryA
ResumeThread
IsProcessorFeaturePresent
GetConsoleCP
CreateProcessA
GetLastError
lstrcmpA
GetCPInfo
EnterCriticalSection
LockResource
SetThreadPriority
GetVersionExA
SetPriorityClass
TerminateProcess
WaitForSingleObject
FileTimeToSystemTime
GetDriveTypeW
SetStdHandle
RtlUnwind
GetShortPathNameA
CreateFileW
GetSystemDefaultUILanguage
_lclose
MoveFileA
FindResourceA
GlobalUnlock
QueryPerformanceFrequency
user32
LoadStringA
LoadIconA
CharUpperA
wsprintfW
GetForegroundWindow
IsWindowVisible
SetForegroundWindow
advapi32
QueryServiceStatusEx
RegEnumKeyW
RegCreateKeyW
CreateServiceW
StartServiceCtrlDispatcherW
OpenProcessToken
DeleteService
SetNamedSecurityInfoW
StartServiceW
CloseServiceHandle
ControlService
OpenServiceW
RegSetValueExW
RegOpenKeyExW
SetEntriesInAclW
ChangeServiceConfigW
SetServiceStatus
SetTokenInformation
RevertToSelf
RegCloseKey
OpenSCManagerW
EnumDependentServicesW
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
CreateProcessAsUserW
BuildExplicitAccessWithNameW
DuplicateTokenEx
ReportEventW
RegCreateKeyExW
RegQueryValueExW
GetNamedSecurityInfoW
DeregisterEventSource
RegOpenKeyW
GetTokenInformation
shell32
SHGetMalloc
SHEmptyRecycleBinW
SHGetSpecialFolderPathW
ole32
CoInitialize
shlwapi
StrStrIW
PathFindFileNameW
PathAppendW
PathQuoteSpacesW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
version
VerQueryValueW
oledlg
ord8
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
psapi
GetModuleInformation
GetModuleFileNameExW
msvcrt
_except_handler3
_exit
__set_app_type
exit
_CIsin
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ