Fake virus pack (version 2[.]1[.]0)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Fake virus pack (version 2.1.0).zip
Size

1.3MB
MD5

80d612a75b09d1f0a70d050fdc14dafb
SHA1

163ebc52369eca9de7c24044990dfe5882cd5b9d
SHA256

c6977f678dc689a099975a34882e5c1bab820d5a51da5ef6c23bf39161084f50
SHA512

7116d84ef1aa53c4cc4d20d6877f6c7d7b427f93940022521e3b68cb72c3322ffe8c19f5b5c5e33f1f6736f5db5646fdf16a25eb612140a31f4aafcdd665bdba
SSDEEP

24576:/yY3Rmp2IYVgFpO+WMXvaSx+sf2FlwoBcMbfJMkP+5Ze6IReBKpDQkPmWoFBBGLS:HLH+3CSx+sfk5BcWf3Gze6I3D9PcFBs2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/virus-launcher.exe

Files

Fake virus pack (version 2.1.0).zip
.zip
LICENCE.txt
README.txt
Virus-Launcher.bat
resources.neu
virus-launcher.exe
.exe windows:6 windows x64 arch:x64

b93f27829bca1e5af53588f050c148c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

GetDeviceCaps

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateFreeThreadedMarshaler
CoInitialize
CoTaskMemAlloc
CoWaitForMultipleHandles
CoInitializeSecurity

oleaut32

SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
VariantClear

ntdll

RtlGetVersion
RtlUnwindEx
VerSetConditionMask
RtlUnwind

dwmapi

DwmSetWindowAttribute

ws2_32

WSAGetLastError
WSAAddressToStringW
WSASetLastError
shutdown
ntohs
WSARecv
setsockopt
WSAStringToAddressW
WSASocketW
ntohl
WSAStartup
listen
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
closesocket
bind
WSACleanup
WSASend

mswsock

AcceptEx
GetAcceptExSockaddrs

kernel32

IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
EnumSystemLocalesW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
WriteConsoleW
GetFileType
GetStdHandle
InterlockedPushEntrySList
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetUserDefaultLCID
GetDriveTypeW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
GetCurrentProcess
GetCurrentThreadId
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
VerifyVersionInfoW
CreateActCtxA
ActivateActCtx
DeactivateActCtx
MultiByteToWideChar
WideCharToMultiByte
GetLastError
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsFree
LocalFree
FormatMessageA
CloseHandle
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
CancelIoEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
TerminateThread
TlsGetValue
TlsSetValue
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
TerminateProcess
OpenProcess
CreateFileW
GetFileSizeEx
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
GetFileInformationByHandleEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
GetModuleHandleW
EnumResourceNamesW
SetFileAttributesA
ExitProcess
GetModuleFileNameA
LoadLibraryExW
GetEnvironmentVariableA
GetFileAttributesA
GetSystemTimeAsFileTime
GetNativeSystemInfo
QueryPerformanceFrequency
GetLogicalProcessorInformation
GlobalMemoryStatusEx
ReadDirectoryChangesW
ReadFile
WriteFile
SetHandleInformation
CreatePipe
GetExitCodeProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeA
InitializeCriticalSection
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
LoadLibraryW
GetEnvironmentVariableW
RtlPcToFileHeader
QueryPerformanceCounter
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetExitCodeThread
SetCurrentDirectoryW
CreateDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
CopyFileW
MoveFileExW
CreateHardLinkW
CreateSymbolicLinkW
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW

user32

LoadIconW
DestroyIcon
GetMessageW
PostThreadMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
IsWindowVisible
IsZoomed
GetSystemMetrics
TrackPopupMenu
GetMenuItemInfoW
SetForegroundWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
DestroyMenu
GetWindowRect
GetWindowLongW
GetForegroundWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetDesktopWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
GetRawInputDeviceList
GetDC
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
RegisterClipboardFormatA
RegisterClipboardFormatW
EmptyClipboard
IsClipboardFormatAvailable
CreatePopupMenu
SendMessageW
GetCursorPos
GetWindowThreadProcessId
EnumWindows
FindWindowW
UpdateWindow
InsertMenuItemW
SetWindowLongW
InsertMenuW
MessageBoxW
GetActiveWindow
PeekMessageW
DispatchMessageW
GetClientRect
TranslateMessage

advapi32

RegOpenKeyExA
RegQueryValueExA
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW

shell32

SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetKnownFolderPath
Shell_NotifyIconW

shlwapi

ord12
PathFindFileNameA
PathRemoveFileSpecW

gdiplus

GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdipCreateHICONFromBitmap
GdipCreateBitmapFromStreamICM
GdipAlloc
GdipFree
GdiplusStartup
GdipCreateBitmapFromStream

Sections

.text
Size: 1.9MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b93f27829bca1e5af53588f050c148c7

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

version

ole32

oleaut32

ntdll

dwmapi

ws2_32

mswsock

kernel32

user32

advapi32

shell32

shlwapi

gdiplus

Sections

.text Size: 1.9MB - Virtual size: 1.8MB

.rdata Size: 464KB - Virtual size: 463KB

.data Size: 50KB - Virtual size: 65KB

.pdata Size: 162KB - Virtual size: 162KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 1.9MB - Virtual size: 1.8MB

.rdata
Size: 464KB - Virtual size: 463KB

.data
Size: 50KB - Virtual size: 65KB

.pdata
Size: 162KB - Virtual size: 162KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 8KB - Virtual size: 8KB