WindowsProgram[.]exe[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

WindowsProgram.exe.vir
Size

28.3MB
MD5

de29f8c89731475ca42f7720220a7c11
SHA1

3fc83dc1ccc11356e6c465cffe2b5d05f9aa6e1b
SHA256

eb5c5693b21bfc9fc73738c6f6c5b3394e21da14101b90365149a8ed34f63750
SHA512

6f016307cc92097d3844e92ad6b6d58e2ab538676dd4415da775d4914092cade79b091a6c90b5c962ac673ebad1954d490aa111a9182c6e4325831b4a7c9fdea
SSDEEP

786432:/KPSqKZhZdgjusRzP6sT7Od06Mz9eZ1LTjXw4d72g4:tqKZvu9CsTMMqlTj1i

Score

1^/10

Malware Config

Signatures

Files

WindowsProgram.exe.vir
.exe windows:5 windows x86 arch:x86

4c5fd16fd31ce7e7a1a17ee683b3917c

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/08/2024, 11:54

Not After

14/08/2025, 11:54

Subject

SERIALNUMBER=91440101MA9XTTGM24,CN=Guangzhou Ningwei Technology Co.\, Ltd.,O=Guangzhou Ningwei Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:58:76:88:cf:8c:a2:4f:11:39:ee:19:60:44:e8:20:79:ac:b0:45:03:58:bc:a3:00:76:8b:cb:c6:3e:84:9b
Signer

Actual PE Digest

78:58:76:88:cf:8c:a2:4f:11:39:ee:19:60:44:e8:20:79:ac:b0:45:03:58:bc:a3:00:76:8b:cb:c6:3e:84:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCP

user32

TranslateMDISysAccel

gdi32

ExtSelectClipRgn

msimg32

AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter

advapi32

RegOpenKeyExW

shell32

DragQueryFileA

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA

ole32

CoFreeUnusedLibraries

oleaut32

SysAllocStringLen

oledlg

ord8

oleacc

LresultFromObject

gdiplus

GdipGetImageGraphicsContext

imm32

ImmGetOpenStatus

winmm

PlaySoundA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 27.0MB - Virtual size: 27.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c5fd16fd31ce7e7a1a17ee683b3917c

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0Certificate

Extended Key Usages

Key Usages

78:58:76:88:cf:8c:a2:4f:11:39:ee:19:60:44:e8:20:79:ac:b0:45:03:58:bc:a3:00:76:8b:cb:c6:3e:84:9bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

msvcrt

iphlpapi

psapi

Sections

.text Size: 27.0MB - Virtual size: 27.0MB

.sedata Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 1KB - Virtual size: 4KB

.rsrc Size: 51KB - Virtual size: 52KB

.sedata Size: 4KB - Virtual size: 4KB

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

65:ad:9c:68:ff:56:0d:83:32:50:4a:35:26:e9:14:c0
Certificate

78:58:76:88:cf:8c:a2:4f:11:39:ee:19:60:44:e8:20:79:ac:b0:45:03:58:bc:a3:00:76:8b:cb:c6:3e:84:9b
Signer

.text
Size: 27.0MB - Virtual size: 27.0MB

.sedata
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 51KB - Virtual size: 52KB

.sedata
Size: 4KB - Virtual size: 4KB