VirusShare_b0adddc4b40e54f17d64148aea1f56c2

Sharing

Copy URL Twitter E-mail

General

Target

VirusShare_b0adddc4b40e54f17d64148aea1f56c2
Size

104KB
MD5

b0adddc4b40e54f17d64148aea1f56c2
SHA1

41738e776ab55e5f18a84e5bd954d3c20d7f221d
SHA256

312b5be57aee11455e879c40b2189f47d55b16996f5d6f6af980b9888e31c54a
SHA512

5f6a1cfdeb4983c42787d5b77416858dfb79490ea164fce1412e9a56c1a04a58a8d998cacab4b89aca7542144b246162768d5777067423ab6bf0a9f38e41caf7
SSDEEP

1536:iGFQ9YQ890PzD6+xMu2P74Ym5Y+nNVPmnGDRbpI4nde:iGFQ2Q890LD9MTP7495Y+nGGNTde

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VirusShare_b0adddc4b40e54f17d64148aea1f56c2

Files

VirusShare_b0adddc4b40e54f17d64148aea1f56c2
.dll windows:4 windows x86 arch:x86

f350f812477ca18adedee8d61a3bc670

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedExchange
FindAtomW
lstrcpyW

gdi32

SetTextJustification
GetViewportOrgEx
DeleteEnhMetaFile
GetTextAlign
IntersectClipRect
TextOutW
GetBkMode
CreateEnhMetaFileA
EnumICMProfilesA
ExtCreatePen
GetWinMetaFileBits
ExtTextOutW
CheckColorsInGamut
CreateDCW
CreatePolygonRgn
SetBkMode
GetGlyphIndicesA
EnumFontFamiliesExW
CreateCompatibleBitmap
SetTextCharacterExtra
CreateHalftonePalette
StretchDIBits
Ellipse

secur32

DecryptMessage
QuerySecurityContextToken
EnumerateSecurityPackagesW
AcquireCredentialsHandleA
QueryCredentialsAttributesW
FreeContextBuffer
ImportSecurityContextW
ApplyControlToken
AddCredentialsW
InitializeSecurityContextW
DeleteSecurityPackageW
AddSecurityPackageA
InitSecurityInterfaceW
QueryContextAttributesW
RevertSecurityContext
CompleteAuthToken
QuerySecurityPackageInfoW
AcceptSecurityContext
QueryCredentialsAttributesA
ImpersonateSecurityContext
VerifySignature
DeleteSecurityContext

Exports

Exports

AssignHLSToCRLsValues
BindArc
CombineDoc
CryptDeriveOut
DescribeMemInfoDocfile
DialogWorldSign
DlgGetReplace
GopherQueryStandard
ImmLower
IntersectPropsTimesBrushByte
LPtoAbortTransform
MkMemSession
OlePrivilegeNotification
PFXVerifyAsciiRequest
PageInfoAuto
PaintRecycleRectFolderNolock
SHAppMailslotPointer
SHAppShowAsyncDosState

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f350f812477ca18adedee8d61a3bc670

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

secur32

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 4KB - Virtual size: 40KB

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 40KB