Virus[.]Win9x[.]CIH[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Virus.Win9x.CIH.zip
Size

9KB
MD5

8eeb278c35f182dee45f5d735901385b
SHA1

f830498f3d5df0ade0d5a187ffaeeb98d0dd337c
SHA256

3d69ea82cb63eb9c39384b1ee5628b040a38bad97fc3dba78edb731dab899e7d
SHA512

b91120c33722a7154d9ae3b7d1b6a7681f8aabe744a7ae81f66bb09bbc6249c6b399884f1d95921033982aee4f62a82cd77a320503ac702f30668ec8fb5afa3a
SSDEEP

192:9IvwWx88Fq/Cd9htuKTAmmQRhzPt06Zqdsup31nZLT+hJ:9IPx8nqd3AOTmQhzHqddTZLTOJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CIH.exe

Files

Virus.Win9x.CIH.zip
.zip
CIH.exe
.exe windows:3 windows x86 arch:x86

4030ac47b2bec11178018951f95ad48c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wsock32

gethostbyname
WSAStartup
ioctlsocket

crtdll

_fmode_dll
_global_unwind2
exit
toupper
sprintf
free
malloc
_pctype_dll
_isctype
__mb_cur_max_dll
sscanf
fprintf
_iob
time
_exit
_XcptFilter
_initterm
__GetMainArgs
_commode_dll
_local_unwind2

kernel32

GetProcessHeap
HeapAlloc
GetLastError
LocalFree
FormatMessageA
GetProcAddress
LoadLibraryA
HeapFree

user32

CharToOemA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ