WindowsProgram[.]exe[.]vir

Sharing

Copy URL

Twitter E-mail

General

Target

WindowsProgram.exe.vir
Size

28.2MB
MD5

ffbd5fba655317972dff0208b0f29bf7
SHA1

aadf16e53909f05581cc97b1f987fea7c20cc67c
SHA256

196d8b0ff2f16afe3b5d564006291a307106bf6a3e0af18bc06d70f2afcfa394
SHA512

56c869578b36d393912fb135bd4c2603a1ac3c79f81bfe1193a57869b290499d990be5058af91ef4e5dfac16067b7436fb37617afde37fade0ee082a0256c842
SSDEEP

393216:feJHbzdq6b3iBccxXv0oeN4aaT791Mu7nxpoDTiju2Nq/0cqfAnWvy:wTiXWoI1aTXz7xpzjuCqsBAn6y

Score

1^/10

Malware Config

Signatures

Files

WindowsProgram.exe.vir
.exe windows:5 windows x86 arch:x86

4c5fd16fd31ce7e7a1a17ee683b3917c

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/08/2024, 11:54

Not After

14/08/2025, 11:54

Subject

SERIALNUMBER=91440101MA9XTTGM24,CN=Guangzhou Ningwei Technology Co.\, Ltd.,O=Guangzhou Ningwei Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:bb:1d:79:a5:30:17:a0:f7:6e:a5:d8:45:06:0a:e7:a8:b7:73:62:88:f6:a3:65:6c:7b:77:bf:1a:90:74:3b
Signer

Actual PE Digest

35:bb:1d:79:a5:30:17:a0:f7:6e:a5:d8:45:06:0a:e7:a8:b7:73:62:88:f6:a3:65:6c:7b:77:bf:1a:90:74:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCP

user32

TranslateMDISysAccel

gdi32

ExtSelectClipRgn

msimg32

AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter

advapi32

RegOpenKeyExW

shell32

DragQueryFileA

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA

ole32

CoFreeUnusedLibraries

oleaut32

SysAllocStringLen

oledlg

ord8

oleacc

LresultFromObject

gdiplus

GdipGetImageGraphicsContext

imm32

ImmGetOpenStatus

winmm

PlaySoundA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 26.9MB - Virtual size: 26.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c5fd16fd31ce7e7a1a17ee683b3917c

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0Certificate

Extended Key Usages

Key Usages

35:bb:1d:79:a5:30:17:a0:f7:6e:a5:d8:45:06:0a:e7:a8:b7:73:62:88:f6:a3:65:6c:7b:77:bf:1a:90:74:3bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

msvcrt

iphlpapi

psapi

Sections

.text Size: 26.9MB - Virtual size: 26.9MB

.sedata Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 1KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0
Certificate

35:bb:1d:79:a5:30:17:a0:f7:6e:a5:d8:45:06:0a:e7:a8:b7:73:62:88:f6:a3:65:6c:7b:77:bf:1a:90:74:3b
Signer

.text
Size: 26.9MB - Virtual size: 26.9MB

.sedata
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB