ShellExecuteHooks COM hijack persistence: upx@0
virussign.com_90f6c6e524be646c8ad437a5f3ad9170.vir
pe
| 0x3a0 |
00000000000000000000000000000000 |
................ |
| 0x3b0 |
00000000000000000000000000000000 |
................ |
| 0x3c0 |
00000000000000000000000000000000 |
................ |
| 0x3d0 |
0000000000000000000000312e323400 |
...........1.24. |
| 0x3e0 |
555058210c09020a2c8f8ba8fccf1ccb |
UPX!....,....... |
| 0x3f0 |
a6b90100977e000000280100260600ae |
.....~...(..&... |
| 0x400 |
b93bb2fd0020c430400005d8eb340b00 |
.;... .0@....4..Compact RWX UPX1 payload section |
| 0x410 |
9437bfff73f3a03701bc3ae80600406e |
.7..s..7..:...@n |
| 0x420 |
20704a23ff53dcdcfc3ea45a05385d05 |
pJ#.S...>.Z.8]. |
| 0x430 |
b06604b864eff3f9dc0ad874f07c0c78 |
.f..d......t.|.x |
| 0x440 |
d081479f9bbbdfdc8805ec8d0b032c90 |
..G...........,. |
| 0x450 |
02a8959097fbfd3e771d06c49c949e05 |
.......>w....... |
| 0x460 |
38a059bca195cff3b9b91478a41548a6 |
8.Y........x..H. |
| 0x470 |
a0a6e0007e7fdf919c5c4805ac9501a3 |
....~....\H..... |
| 0x480 |
500b2a5477e4fbf995500078676bb4e0 |
P.*Tw....P.xgk.. |
| 0x490 |
950bff7fb1e710964c5f00eb1066623a |
........L_...fb: |
| 0x4a0 |
432b2b484f4fdd7d77fb4b90e998d017 |
C++HOO.}w.K..... |
| 0x4b0 |
a18b04c1e002a38f07526a00bedd5ddb |
.........Rj...]. |
| 0x4c0 |
f7b39e130637ac5a052ab40ab0ec60ee |
.....7.Z.*....`. |
| 0x4d0 |
c7184b785968342625a3930bb7fbdd65 |
..KxYh4&%......e |
| 0x4e0 |
e98cd4044bc433c0a07d12c3a1 |
....K.3..}... |
| 0x87c0 |
00000000000000000000000000000000 |
................ |
| 0x87d0 |
00000000000000000000000000000000 |
................ |
| 0x87e0 |
00000000000000000000000000000000 |
................ |
| 0x87f0 |
00000000000000000000000000000000 |
................ |
| 0x8800 |
4d5a50000200000004000f00ffff0000 |
MZP............. |
| 0x8810 |
b80000000000000040001a0000000000 |
........@....... |
| 0x8820 |
00000000000000000000000000000000 |
................ |
| 0x8830 |
00000000000000000000000000020000 |
................ |
| 0x8840 |
ba10000e1fb409cd21b8014ccd219090 |
........!..L.!.. |
| 0x8850 |
546869732070726f6772616d206d7573 |
This program mus |
| 0x8860 |
742062652072756e20756e6465722057 |
t be run under W |
| 0x8870 |
696e33320d0a24370000000000000000 |
in32..$7........ |
| 0x8880 |
00000000000000000000000000000000 |
................ |
| 0x8890 |
0000000000000000000000000000 |
.............. |
| 0xc41a |
15adada52d20fe00eeea10cdd39208f7 |
....- .......... |
| 0xc42a |
53fe75031a1b03726d6d499c240466ea |
S.u....rmmI.$.f. |
| 0xc43a |
02851640051a36b16a0517a507705e53 |
...@..6.j....p^S |
| 0xc44a |
0939e4400a22199009a9810b25f60b9c |
.9.@."......%... |
| 0xc45a |
0cc6909c74b821cbe8ca0fca9cf29f3e |
....t.!........> |
| 0xc46a |
34232f3b3bf467e828bafcba446c21cb |
4#/;;.g.(...Dl!. |
| 0xc47a |
06095220f16e144ab0bdadc30288e490 |
..R .n.J........ |
| 0xc48a |
8eb7e22c06e3d2c9eee49021b1a82347 |
...,.......!..#G |
| 0xc49a |
db0a15913071fe1309cfc7909b15740d |
....0q........t. |
| 0xc4aa |
eff39c651bb302ae1df20b2a361a5cc4 |
...e.......*6.\. |
| 0xc4ba |
47757c85fae13f2e90411efffc20eb2e |
Gu|...?..A... .. |
| 0xc4ca |
d2e1961e1baaaf144a269be418fe64ec |
........J&....d. |
| 0xc4da |
0891c7f69c8b3981f17e656b756c4b11 |
......9..~ekulK. |
| 0xc4ea |
2c0b423d8a4d50c8bad70b140e111fec |
,.B=.MP......... |
| 0xc4fa |
14e4ac106b271c6bb652ac91e61c4843 |
....k'.k.R....HCWinlogon registry path reference |
| 0xc50a |
45add44e68030314142303a12ccd4a24 |
E..Nh....#..,.J$ |
| 0xc51a |
4a270c6a51d2f90eeb9a2b2f234d178a |
J'.jQ.....+/#M..Winlogon Notify subkey |
| 0xc52a |
4d7b00317b25826de52566833ffe10a4 |
M{.1{%.m.%f.?... |
| 0xc53a |
2193e46335db33d93c9b2bdc3c75e0f4 |
!..c5.3.<.+.<u.. |
| 0xc54a |
7726cc13312dbc69111b1f0199dcdcfc |
w&..1-.i........ |
| 0xc55a |
769f96c2d0da13bc45f703f601b780ae |
v.......E....... |
| 0xc56a |
d907f5f403f3c0ecbedad05c148f2210 |
...........\..". |
| 0xc57a |
68655ac06d5b03dc02e08e55e49a7a68 |
heZ.m[.....U..zh |
| 0xc58a |
0f0c33c3ff28a2ffb3d2465127454095 |
..3..(....FQ'E@. |
| 0xc59a |
301421fa8694966b54f6c3809d1a75fc |
0.!....kT.....u. |
| 0xc5aa |
677dd4ff4d180f880f6e8386bfa37785 |
g}..M....n....w. |
| 0xc5ba |
946e01eb0d838c1eb2018855f5e4cf8d |
.n.........U.... |
| 0xc5ca |
6d02f720ee9255451450446cb7d6a39b |
m.. ..UE.PDl.... |
| 0xc5da |
751805f59b61a9ad222e49db8042084e |
u....a..".I..B.N |
| 0xc5ea |
5ba3ce2ce5b900ba883b8ab111fbd875 |
[..,.....;.....u |
| 0xc5fa |
1c817dd7e6afbc5d19622992d6f5e7eb |
..}....].b)..... |
| 0xc60a |
2d3f36b6a43030f597ddfb398e51eb68 |
-?6..00....9.Q.h |
| 0xc61a |
f408ebe2e12c692958d81a98db18e9be |
.....,i)X....... |
| 0xc62a |
daf1b0123d68cbbd4c84665b9f951cfa |
....=h..L.f[.... |
| 0xc63a |
bb17fe097f7c0796a242c503c0a3e007 |
.....|...B...... |
| 0xc64a |
a2a1b6c7143b75f85140c517c2d15b01 |
.....;u.Q@....[. |
| 0xc65a |
436dc48b4f643e7229585e506f61c00b |
Cm..Od>r)X^Poa.. |
| 0xc66a |
8d56ffdbd688b9492f67240f75c8221d |
.V.....I/g$.u.". |
| 0xc67a |
2b40be0fbb65742b98dba8ce |
+@...et+.... |
| 0xd01a |
5ee3741464802680df13ed0d45eb108d |
^.t.d.&.....E... |
| 0xd02a |
f67e63674b8911a104a3a85b15b6d886 |
.~cgK......[.... |
| 0xd03a |
7915ac3effa18c84368b784721a1682a |
y..>....6.xG!.h* |
| 0xd04a |
283add84621d4d0d77acb0a4f75c543b |
(:..b.M.w....\T; |
| 0xd05a |
05bc45bc2df675348307e91506de77be |
..E.-.u4......w. |
| 0xd06a |
b69d52c43f5199a30d8211fc22e86c0a |
..R.?Q......".l. |
| 0xd07a |
3270901e009945d9405024e992144025 |
2p....E.@P$...@% |
| 0xd08a |
964003d82a21a0fe477c57c01945f3cc |
.@..*!..G|W..E.. |
| 0xd09a |
8bc7c1e9028cbd10875ed2dea184ddbc |
.........^...... |
| 0xd0aa |
04e2f0fe1c90ff0508da0b815b75c588 |
............[u.. |
| 0xd0ba |
5d9875f8538b1031b889036a826d3cc7 |
].u.S..1...j.m<. |
| 0xd0ca |
bf057cff038b0bde2074f63c0974f233 |
..|..... t.<.t.3 |
| 0xd0da |
e2c95a6b3a22cb14182274044cd60c66 |
..Zk:"..."t.L..f |
| 0xd0ea |
ac1816123108fdc296cf1cee52c78906 |
....1.......R... |
| 0xd0fa |
a390b20f1688f24dbbe4c0d0401e7b57 |
.......M....@.{W |
| 0xd10a |
f182d533ff77038a00005f6cc5009961 |
...3.w...._l...a |
| 0xd11a |
0ea035db1bfceb443c6d250abbb2b3d8 |
..5....D<m%..... |
| 0xd12a |
e9ff832f8eeaa75ef56dec1b8c2a163c |
.../...^.m...*.< |
| 0xd13a |
3f7505f35d7c59c831a7ac8b16feff6c |
?u..]|Y.1......l |
| 0xd14a |
9cd88806eb1358bff4f2f010a3ed090c |
......X......... |
| 0xd15a |
17f4bc06740b548039a0a42c4cd00c2c |
....t.T.9..,L.., |
| 0xd16a |
c5bc8672a38854425b90245852f14612 |
...r..TB[.$XR.F. |
| 0xd17a |
1b397a7ba2da08465c7510c707d5dabe |
.9z{...F\u...... |
| 0xd18a |
ac0a8b0ac60683c1949c5c3656bc |
..........\6V. |
| 0x1102c |
c6c471b3b55de70cb9133eed4dccb859 |
..q..]....>.M..Y |
| 0x1103c |
e7c6bd90591aae40fd6a4828f2f93ae3 |
....Y..@.jH(..:. |
| 0x1104c |
8656fce077c2f75c12fca456bf3bea3c |
.V..w..\...V.;.< |
| 0x1105c |
d64a716a823621bfa97afc0500fb85b5 |
.Jqj.6!..z...... |
| 0x1106c |
68c6a8fbd83556cdb9a0a8d3471cbf4c |
h....5V.....G..L |
| 0x1107c |
d1818a0877aef2c0fe84bc17acfc8962 |
....w..........b |
| 0x1108c |
db3430afb4c03d81549aa94f25c7e910 |
.40...=.T..O%... |
| 0x1109c |
8f049044d47455214c2c609a31115cde |
...D.tU!L,`.1.\. |
| 0x110ac |
3d4c2306f8e792a93cd2fb4bd8a91c26 |
=L#.....<..K...& |
| 0x110bc |
4fec0ad1bc31a87dec9afbba5c3f89dc |
O....1.}....\?.. |
| 0x110cc |
a7bf7cda57f1b0066d5f27e532f8ffd4 |
..|.W...m_'.2... |
| 0x110dc |
e00a8302847cdf088459133cf38663c8 |
.....|...Y.<..c. |
| 0x110ec |
d5572dc36502523b8d48106d78f5c370 |
.W-.e.R;.H.mx..p |
| 0x110fc |
e22991d73cc97cf6caf40e646b4cea2a |
.)..<.|....dkL.* |
| 0x1110c |
88ee3bf93fd454bcef0543f2f1e25e95 |
..;.?.T...C...^. |
| 0x1111c |
f6d15c90bfc65f55faa0c0d7d6e88cfb |
..\..._U........ |
| 0x1112c |
30fd847d45f50bb0ae233da85cad8e6a |
0..}E....#=.\..j |
| 0x1113c |
5ed46143db01e302845e8d868bc0bacc |
^.aC.....^...... |
| 0x1114c |
fd21d7f5ac61a967462c5120a7733968 |
.!...a.gF,Q .s9h |
| 0x1115c |
6b7b9e163e44c0de1ef884019017ba7b |
k{..>D.........{ |
| 0x1116c |
d42dfe77eb39ab6cca3e59e162dece50 |
.-.w.9.l.>Y.b..P |
| 0x1117c |
225d076f739affbac98f64f9999c69f5 |
"].os.....d...i. |
| 0x1118c |
3815f2d309231064d67920820dc18399 |
8....#.d.y ..... |
| 0x1119c |
a2a2b9c5ef66e747281f04aae4003ef2 |
.....f.G(.....>. |
| 0x111ac |
a63026ef3f0282821434514bc768b665 |
.0&.?....4QK.h.e |
| 0x111bc |
e7febe0dbaeaac |
....... |