Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_5dce19699be78fa82e32a96aee436c44.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
VirusShare_5dce19699be78fa82e32a96aee436c44.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_5dce19699be78fa82e32a96aee436c44
-
Size
176KB
-
MD5
5dce19699be78fa82e32a96aee436c44
-
SHA1
8c5d7985b67e8182f6f3c80045ed63cf3e7ab919
-
SHA256
7dbc7f99f763e0601c2bdfbabdfa6e0382dad43c5d1fffb40eb2a886368efbc2
-
SHA512
c7c737549cbca125fba191fcf832944b1fe58ff0cc06e2e07a73b551496fabc610c6015fad9706737719712597e93b2026028be744e4e92e217201b00eb4ec5c
-
SSDEEP
3072:uiBpRORG+pRtqH7c4YI0rcM2t+/E0D8qZJ7JI38:5Itg7vHtn0DbZI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare_5dce19699be78fa82e32a96aee436c44
Files
-
VirusShare_5dce19699be78fa82e32a96aee436c44.exe windows:5 windows x86 arch:x86
3819edb040a2c9523511c06e63bcf34b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
GetLastError
WideCharToMultiByte
FileTimeToDosDateTime
GetStdHandle
WaitForMultipleObjects
GetFileAttributesExA
HeapAlloc
SetFileTime
SetLastError
GetStartupInfoW
SetCurrentDirectoryA
WriteFile
SizeofResource
CreateFileA
GetCurrentThreadId
WriteConsoleW
GetConsoleMode
SystemTimeToFileTime
IsValidCodePage
SearchPathA
CopyFileA
lstrcpynA
FreeLibrary
GetCurrentDirectoryW
GetShortPathNameA
lstrcatA
DeleteFileA
FindCloseChangeNotification
HeapFree
TlsSetValue
LeaveCriticalSection
LocalReAlloc
FreeResource
LockResource
GetModuleFileNameA
EnterCriticalSection
lstrcpyA
GetLocalTime
InterlockedExchange
GetEnvironmentStringsW
GetVersionExA
WritePrivateProfileStringA
CompareFileTime
RemoveDirectoryA
GetStringTypeW
OpenFile
SetErrorMode
FindResourceA
EnumResourceLanguagesA
HeapSetInformation
GetDriveTypeA
FlushFileBuffers
MoveFileA
GetDriveTypeW
ConvertDefaultLocale
DeleteCriticalSection
SetFilePointer
LoadLibraryExA
GetPrivateProfileStringA
GetProcessHeap
GlobalGetAtomNameA
MulDiv
FindFirstChangeNotificationA
GetProfileIntA
GetUserDefaultUILanguage
lstrcmpiA
UnlockFile
GetLocaleInfoA
CreateThread
GetCPInfo
MapViewOfFile
WaitForSingleObject
GlobalLock
SetStdHandle
IsDebuggerPresent
GetVolumeInformationA
SuspendThread
TlsAlloc
LoadLibraryA
WinExec
ReplaceFileA
lstrcmpA
SetThreadPriority
GetCurrentProcessId
RaiseException
LoadResource
CreateDirectoryA
SetEnvironmentVariableA
GlobalFree
GetFileTime
GetSystemDefaultUILanguage
GetUserDefaultLangID
TlsFree
FindResourceW
GetFileAttributesA
FormatMessageA
GetFileSize
CompareStringA
SetPriorityClass
InitializeCriticalSectionAndSpinCount
GlobalDeleteAtom
TlsGetValue
QueryPerformanceCounter
GlobalReAlloc
GetCommandLineA
IsProcessorFeaturePresent
GetTempPathA
GetCurrentDirectoryA
DosDateTimeToFileTime
CreateEventA
LocalLock
GetDiskFreeSpaceA
EnumResourceNamesA
lstrlenW
LCMapStringW
HeapSize
GetFileSizeEx
LocalFileTimeToFileTime
GetModuleFileNameW
FindResourceExW
GlobalFindAtomA
LocalUnlock
InterlockedIncrement
GlobalFlags
RtlUnwind
CreateProcessA
GetSystemTimeAsFileTime
TerminateProcess
LocalFree
LocalAlloc
GetConsoleCP
GetCurrentThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
GetWindowsDirectoryA
FileTimeToSystemTime
CloseHandle
GetPrivateProfileIntA
GetTimeZoneInformation
HeapQueryInformation
GetFileType
GetSystemDirectoryW
GetStringTypeExA
MultiByteToWideChar
ResumeThread
GetSystemInfo
lstrcmpW
GlobalHandle
GetFileInformationByHandle
GetThreadLocale
UnhandledExceptionFilter
FindNextChangeNotification
CreateFileW
GetTempFileNameA
SetEndOfFile
QueryPerformanceFrequency
DuplicateHandle
CompareStringW
GlobalSize
SetFileAttributesA
FindResourceExA
FreeEnvironmentStringsW
lstrlenA
GetFullPathNameA
CreateFileMappingA
LockFile
ResetEvent
SetUnhandledExceptionFilter
Sleep
HeapCreate
GetOEMCP
InterlockedDecrement
EnumResourceTypesA
GlobalAlloc
SetEvent
SetHandleCount
GetNumberFormatA
AreFileApisANSI
VirtualProtect
CancelIo
GetModuleHandleA
AddAtomA
AddAtomW
OpenWaitableTimerA
GetProcAddress
GetACP
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
GlobalUnlock
GlobalAddAtomA
user32
RemoveMenu
DispatchMessageW
ScreenToClient
GetParent
ReleaseDC
GetWindowRect
GetWindowThreadProcessId
DrawTextW
PtInRect
LoadMenuW
GetWindowDC
LoadStringW
PostMessageW
DestroyMenu
GetWindowLongW
UnregisterClassA
GetCursorPos
SetWindowPos
UpdateLayeredWindow
GetWindowTextW
MessageBeep
GetFocus
MapWindowPoints
ShowWindow
DefWindowProcW
GetMonitorInfoW
TrackMouseEvent
InvalidateRect
IsWindow
PeekMessageW
TranslateAcceleratorW
SetFocus
SetWindowTextW
MonitorFromPoint
KillTimer
PostQuitMessage
GetWindow
GetMessageW
TranslateMessage
CallWindowProcW
AppendMenuW
DestroyCursor
SetForegroundWindow
LoadStringA
LoadIconA
GetKeyboardLayout
CharLowerA
IsWindowUnicode
GetDesktopWindow
GetMenuItemCount
LoadImageW
EnumChildWindows
EnumWindows
LoadCursorW
CreatePopupMenu
MonitorFromWindow
SetWindowLongW
GetMenuItemInfoW
GetClassNameW
TrackPopupMenuEx
GetClientRect
SetCursor
SendMessageW
SetTimer
CharNextW
advapi32
EnumDependentServicesW
RegOpenKeyW
RegQueryValueExW
SetTokenInformation
RegCreateKeyW
SetServiceStatus
BuildExplicitAccessWithNameW
OpenServiceW
RegOpenKeyExW
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
QueryServiceStatusEx
CreateProcessAsUserW
CreateServiceW
ControlService
OpenSCManagerW
RegSetValueExW
ReportEventW
StartServiceCtrlDispatcherW
SetEntriesInAclW
GetTokenInformation
ChangeServiceConfigW
OpenProcessToken
DeleteService
GetNamedSecurityInfoW
DuplicateTokenEx
RegCreateKeyExW
SetNamedSecurityInfoW
StartServiceW
RegEnumKeyW
RegCloseKey
RevertToSelf
CloseServiceHandle
DeregisterEventSource
shell32
SHGetMalloc
SHGetSpecialFolderPathW
SHEmptyRecycleBinW
ole32
CoInitialize
shlwapi
PathCombineW
PathQuoteSpacesW
PathFileExistsW
PathAppendW
StrStrIW
PathRemoveFileSpecW
PathFindFileNameW
version
VerQueryValueW
oledlg
ord8
OleUIBusyW
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
psapi
GetModuleBaseNameA
GetModuleFileNameExW
GetModuleInformation
msvcrt
_CIsin
_except_handler3
__set_app_type
_exit
exit
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ