2024-07-28_98f0cc6112c10a60cb15c8f275a3b36c_virlock | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-28_98f0cc6112c10a60cb15c8f275a3b36c_virlock
Size

713KB
MD5

98f0cc6112c10a60cb15c8f275a3b36c
SHA1

8ba76a8d5430bb28dd24e0b071d4a56394bf659d
SHA256

6e49c27dc3ecd2665aad1a1d57276d1e6fe447f7083c03cc20ec5641f70562a5
SHA512

5f3bb82bd6b8b90d4b8dbf99f17e8d0cdeaf1a2a3e4bf94424a029ceaf7a39a9132795f0584e02ff64269e4b74a61d1944fb49712f659edfe654cb4ca85a0eed
SSDEEP

12288:FjcOYGW3Vvie/8rwbB44M5Ol27V6fUk8tXMcQ1z1vDz2zjCBfpud+TRPMGN:FjcikVvi9ryBBMgQ7Zk8JQ1BeOBfc+Vd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-28_98f0cc6112c10a60cb15c8f275a3b36c_virlock

Files

2024-07-28_98f0cc6112c10a60cb15c8f275a3b36c_virlock
.exe windows:4 windows x86 arch:x86

03e04b18c9560def09e4d477202e8df6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlCopySidAndAttributesArray
DbgPrint

kernel32

GetVersion
CreateDirectoryA
FindFirstFileExA
GetConsoleWindow

user32

ToUnicodeEx
GetProcessWindowStation
BeginPaint

Sections

.text
Size: 709KB - Virtual size: 712KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE