Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_4f71885d01582e58a9f66bea5a251153.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
VirusShare_4f71885d01582e58a9f66bea5a251153.exe
Resource
win10v2004-20240426-en
General
-
Target
VirusShare_4f71885d01582e58a9f66bea5a251153
-
Size
196KB
-
MD5
4f71885d01582e58a9f66bea5a251153
-
SHA1
1c2fe57719989c29314f31126c605dc3b855d068
-
SHA256
f6ee794f703ff4cf293c27cf19b871f1d3f4e2e744a85d49da12ae120cb9fc4e
-
SHA512
d6b20daa260e7faa7cb176bfc6fe6a8ed87775b2506618716e8446087375e43d10f974f68eaba2ab4d4a440ab017e0d98bb46c2c7b54d7495e1b0cd5bf263c92
-
SSDEEP
3072:vszQfZnucCyiqxFgkhJZfoQeg1SXBpjQ1ODXQppvXdWdBAWYYNz5a:+gAcLfekrZfoQeQSdDgpxXdqH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_4f71885d01582e58a9f66bea5a251153
Files
-
VirusShare_4f71885d01582e58a9f66bea5a251153.exe windows:4 windows x86 arch:x86
c8d92a36ffe7d134af6b558ae26e4e18
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
GlobalFlags
GetSystemPowerStatus
FormatMessageW
_lread
FindAtomA
OpenSemaphoreA
wininet
InternetOpenUrlA
FtpGetCurrentDirectoryA
GopherOpenFileA
FindCloseUrlCache
HttpQueryInfoW
DeleteUrlCacheGroup
HttpOpenRequestW
SetUrlCacheEntryGroup
InternetConnectA
InternetSetOptionW
CreateUrlCacheGroup
FtpPutFileA
SetUrlCacheEntryInfoA
InternetTimeFromSystemTime
FtpRenameFileW
InternetCrackUrlW
InternetOpenA
InternetCreateUrlA
InternetOpenUrlW
InternetQueryOptionA
InternetDial
HttpEndRequestW
DeleteUrlCacheEntry
HttpSendRequestW
GetUrlCacheEntryInfoW
RetrieveUrlCacheEntryStreamA
FindFirstUrlCacheEntryW
HttpOpenRequestA
InternetCanonicalizeUrlA
InternetQueryOptionW
InternetGetConnectedState
CreateUrlCacheEntryW
InternetAttemptConnect
InternetCheckConnectionA
GopherGetAttributeW
InternetCanonicalizeUrlW
FtpSetCurrentDirectoryW
InternetGetCookieA
InternetOpenW
UnlockUrlCacheEntryStream
FindFirstUrlCacheEntryA
CreateUrlCacheEntryA
FtpSetCurrentDirectoryA
InternetReadFileExW
HttpSendRequestExA
RetrieveUrlCacheEntryFileA
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoA
FtpRemoveDirectoryA
InternetGoOnline
FtpCreateDirectoryW
FtpOpenFileA
InternetCombineUrlA
InternetLockRequestFile
GetUrlCacheEntryInfoExW
InternetSetCookieA
InternetCrackUrlA
HttpEndRequestA
HttpQueryInfoA
InternetConfirmZoneCrossing
InternetConnectW
GopherFindFirstFileA
advapi32
RegisterServiceCtrlHandlerA
RegSetValueA
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyA
RegUnLoadKeyW
QueryServiceConfigW
RevertToSelf
RegCloseKey
GetAce
StartServiceA
RegCreateKeyW
CreateProcessAsUserW
RegOpenKeyExW
GetKernelObjectSecurity
OpenSCManagerA
SetEntriesInAclW
MakeAbsoluteSD
AddAce
InitializeSecurityDescriptor
RegRestoreKeyW
RegConnectRegistryA
CopySid
SetSecurityDescriptorGroup
RegQueryValueW
SetSecurityDescriptorSacl
RegEnumKeyW
InitiateSystemShutdownA
CloseServiceHandle
ReportEventA
DeleteService
SetFileSecurityA
GetSidIdentifierAuthority
rasapi32
RasEnumDevicesW
RasGetProjectionInfoW
RasCreatePhonebookEntryA
RasEnumDevicesA
RasRenameEntryA
RasValidateEntryNameA
RasEnumEntriesW
RasCreatePhonebookEntryW
RasGetEntryDialParamsA
RasValidateEntryNameW
RasDialW
RasGetEntryPropertiesW
RasEditPhonebookEntryW
RasEnumEntriesA
RasHangUpA
RasGetErrorStringA
RasSetEntryPropertiesA
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ