Packed PE loader with writable entry and dynamic API resolution: upx@0
ShellExecuteHooks COM hijack persistence: upx@0
virussign.com_3922f1b36bfb1d052ec880685830f390.vir
pe
| 0x3a0 |
00000000000000000000000000000000 |
................ |
| 0x3b0 |
00000000000000000000000000000000 |
................ |
| 0x3c0 |
00000000000000000000000000000000 |
................ |
| 0x3d0 |
0000000000000000000000312e323400 |
...........1.24. |
| 0x3e0 |
555058210c09020a2c8f8ba8fccf1ccb |
UPX!....,....... |
| 0x3f0 |
a6b90100977e000000280100260600ae |
.....~...(..&... |
| 0x400 |
b93bb2fd0020c430400005d8eb340b00 |
.;... .0@....4..Compact RWX UPX1 payload section |
| 0x410 |
9437bfff73f3a03701bc3ae80600406e |
.7..s..7..:...@n |
| 0x420 |
20704a23ff53dcdcfc3ea45a05385d05 |
pJ#.S...>.Z.8]. |
| 0x430 |
b06604b864eff3f9dc0ad874f07c0c78 |
.f..d......t.|.x |
| 0x440 |
d081479f9bbbdfdc8805ec8d0b032c90 |
..G...........,. |
| 0x450 |
02a8959097fbfd3e771d06c49c949e05 |
.......>w....... |
| 0x460 |
38a059bca195cff3b9b91478a41548a6 |
8.Y........x..H. |
| 0x470 |
a0a6e0007e7fdf919c5c4805ac9501a3 |
....~....\H..... |
| 0x480 |
500b2a5477e4fbf995500078676bb4e0 |
P.*Tw....P.xgk.. |
| 0x490 |
950bff7fb1e710964c5f00eb1066623a |
........L_...fb: |
| 0x4a0 |
432b2b484f4fdd7d77fb4b90e998d017 |
C++HOO.}w.K..... |
| 0x4b0 |
a18b04c1e002a38f07526a00bedd5ddb |
.........Rj...]. |
| 0x4c0 |
f7b39e130637ac5a052ab40ab0ec60ee |
.....7.Z.*....`. |
| 0x4d0 |
c7184b785968342625a3930bb7fbdd65 |
..KxYh4&%......e |
| 0x4e0 |
e98cd4044bc433c0a07d12c3a1 |
....K.3..}... |
| 0xc41a |
ea96fb8eb6595c572bb7279df248119e |
.....Y\W+.'..H.. |
| 0xc42a |
cb0a86c33a23d3a4af08396a2efaaaa7 |
....:#....9j.... |
| 0xc43a |
dced4ec31c51a075567f62afb9726b7c |
..N..Q.uV.b..rk| |
| 0xc44a |
6f55f16d83908661b62e72228a42c891 |
oU.m...a..r".B.. |
| 0xc45a |
d83e1150be1ca370d5111ad7e71d09fe |
.>.P...p........ |
| 0xc46a |
505ea801d8867c97587d3c98a67b77b5 |
P^....|.X}<..{w. |
| 0xc47a |
f0ac3b037628cf43098520dd9ee78f04 |
..;.v(.C.. ..... |
| 0xc48a |
66419192a146fdd53ea5b472a8fa940d |
fA...F..>..r.... |
| 0xc49a |
0ca6bbd6542d2d04aeb8d8c7405eaacc |
....T--.....@^.. |
| 0xc4aa |
67220c6a549be43a603c347499e1367b |
g".jT..:`<4t..6{ |
| 0xc4ba |
1c40d702a4050ebf0740fbe7f5a98ec7 |
.@.......@...... |
| 0xc4ca |
6c167d2d8a4034fa9620a7f32885bac8 |
l.}-.@4.. ..(... |
| 0xc4da |
04531c7c94e7c253ac50bbb4eaeeaa47 |
.S.|...S.P.....G |
| 0xc4ea |
b500ae8d38bdd6e6f0f8d333be63997e |
....8......3.c.~ |
| 0xc4fa |
554c5f7f29760667bb6fc72975532409 |
UL_.)v.g.o.)uS$.Winlogon registry path reference |
| 0xc50a |
2dff39c5a492abd031428accbcf3e8b7 |
-.9.....1B...... |
| 0xc51a |
ffee378d4d86ac0f4ecd906b86549d59 |
..7.M...N..k.T.YWinlogon Notify subkey |
| 0xc52a |
e985f7cbd311c2d70cdedf615046a978 |
...........aPF.x |
| 0xc53a |
4636790bbfd5a87cc432b2b699900246 |
F6y....|.2.....F |
| 0xc54a |
dd7932f6df3f9a4e4a7d5c7ecdb65e7b |
.y2..?.NJ}\~..^{ |
| 0xc55a |
df23903b20f1e6891c8838250f129376 |
.#.; .....8%...v |
| 0xc56a |
8bb83cef65edf75d8947f6beb04d2de1 |
..<.e..].G...M-. |
| 0xc57a |
aac10a899fcdd4470d6fe69e1e3291ef |
.......G.o...2.. |
| 0xc58a |
94ea139173d58e6373fca9e63306d275 |
....s..cs...3..u |
| 0xc59a |
a2306b4cb795ad94ce8824ef2c7a8518 |
.0kL......$.,z.. |
| 0xc5aa |
5339fefb481ff35a21f8a2b5c86342ff |
S9..H..Z!....cB. |
| 0xc5ba |
4a3ccee773a02bd531998edd5911e5e8 |
J<..s.+.1...Y... |
| 0xc5ca |
52fb660875f4242acbe35d405b01ce61 |
R.f.u.$*..]@[..a |
| 0xc5da |
814b0422e45d0d1e981bc295f132582a |
.K.".].......2X* |
| 0xc5ea |
f05768c041930497b608c12e34179be8 |
.Wh.A.......4... |
| 0xc5fa |
54aabf3c69c81d294834879543f48e4c |
T..<i..)H4..C..L |
| 0xc60a |
7f273c243c4114f9d0b1f93c822dc9f3 |
.'<$<A.....<.-.. |
| 0xc61a |
8b66266baf6d791e98088c977c97b3f2 |
.f&k.my.....|... |
| 0xc62a |
72bbccb92a77c8abfd2cffc47bdd3e26 |
r...*w...,..{.>& |
| 0xc63a |
615a1e98c7d5d5f888092f1f667a1c3b |
aZ......../.fz.; |
| 0xc64a |
8a6a7162b84b0ed805bb944d8955915f |
.jqb.K.....M.U._ |
| 0xc65a |
b5dcebf45b59378a2902f6a5ae097bbb |
....[Y7.).....{. |
| 0xc66a |
0b52aec0c8446b129dab27c7dffc5ea7 |
.R...Dk...'...^. |
| 0xc67a |
d4d079d6e0e4552f6b8e077f |
..y...U/k... |
| 0xd01a |
3621c8e6ea520375e2b7e437d956f2e4 |
6!...R.u...7.V.. |
| 0xd02a |
9cf108fe0fe779fd29e851229531be16 |
......y.).Q".1.. |
| 0xd03a |
def9257cb2aede9feac0efadb24fd82d |
..%|.........O.- |
| 0xd04a |
0125127c1b94aa6d76cfe830e4e8727a |
.%.|...mv..0..rz |
| 0xd05a |
775b0dfe3457e192bd49055599f23541 |
w[..4W...I.U..5A |
| 0xd06a |
67299621694264941f75856945f68843 |
g).!iBd..u.iE..C |
| 0xd07a |
76ec08a53def90912747e6e608fbba09 |
v...=...'G...... |
| 0xd08a |
8a702ae456c548b54db62aa44bc003c3 |
.p*.V.H.M.*.K... |
| 0xd09a |
02f0c29a87542b25be67af3f16e364ce |
.....T+%.g.?..d. |
| 0xd0aa |
79bfe211babc5435090fe2019356fea6 |
y.....T5.....V.. |
| 0xd0ba |
b78511a38b93204da80db81824faa828 |
...... M....$..( |
| 0xd0ca |
42865322db8c91e1097ab87c0e51725a |
B.S".....z.|.QrZ |
| 0xd0da |
4f0a6e34c798fb89899aa8a230c44bd1 |
O.n4........0.K. |
| 0xd0ea |
5a7b4cc3b9eb4a3dce42d2d5149f3bdc |
Z{L...J=.B....;. |
| 0xd0fa |
179dbf25a59c47ede410bd5a79f15cd0 |
...%..G....Zy.\. |
| 0xd10a |
69d8691490d4031374dd24ebb45cd92a |
i.i.....t.$..\.* |
| 0xd11a |
05d73303a1d2319ff5bde0ea22d596ac |
..3...1....."... |
| 0xd12a |
26f2a9b464bda9b02591460297f5655c |
&...d...%.F...e\ |
| 0xd13a |
1ab38da1094ff634f0a77361c99ab5af |
.....O.4..sa.... |
| 0xd14a |
f138e82e9a76c5d3884c4a929eb23337 |
.8...v...LJ...37 |
| 0xd15a |
daad2f947d556106dc150351ef8032ec |
../.}Ua....Q..2. |
| 0xd16a |
1213215f421ed96e281d2128b26c1790 |
..!_B..n(.!(.l.. |
| 0xd17a |
7d8208dee26a825fdfda7c1ca915b49a |
}....j._..|..... |
| 0xd18a |
6c35557f5baec7ae923a485bdf6f |
l5U.[....:H[.o |
| 0x1102c |
00000000000000000000000000000000 |
................ |
| 0x1103c |
00000000000000000000000000000000 |
................ |
| 0x1104c |
00000000000000000000000000000000 |
................ |
| 0x1105c |
00000000000000000000000000000000 |
................ |
| 0x1106c |
00000000000000000000000000000000 |
................ |
| 0x1107c |
00000000000000000000000000000000 |
................ |
| 0x1108c |
00000000000000000000000000000000 |
................ |
| 0x1109c |
00000000000000000000000000000000 |
................ |
| 0x110ac |
00000000000000000000000000000000 |
................ |
| 0x110bc |
00000000000000000000000000000000 |
................ |
| 0x110cc |
00000000000000000000000000000000 |
................ |
| 0x110dc |
00000000000000000000000000000000 |
................ |
| 0x110ec |
00000000000000000000000000000000 |
................ |
| 0x110fc |
00000000000000000000000000000000 |
................ |
| 0x1110c |
00000000000000000000000000000000 |
................ |
| 0x1111c |
00000000000000000000000000000000 |
................ |
| 0x1112c |
00000000000000000000000000000000 |
................ |
| 0x1113c |
00000000000000000000000000000000 |
................ |
| 0x1114c |
00000000000000000000000000000000 |
................ |
| 0x1115c |
00000000000000000000000000000000 |
................ |
| 0x1116c |
00000000000000000000000000000000 |
................ |
| 0x1117c |
00000000000000000000000000000000 |
................ |
| 0x1118c |
00000000000000000000000000000000 |
................ |
| 0x1119c |
00000000000000000000000000000000 |
................ |
| 0x111ac |
00000000000000000000000000000000 |
................ |
| 0x111bc |
00000000000000 |
....... |
| 0x111d8 |
00000000000000000000000000000000 |
................ |
| 0x111e8 |
00000000000000000000000000000000 |
................ |
| 0x111f8 |
00000000000000000000000000000000 |
................ |
| 0x11208 |
00000000000000000000000000000000 |
................ |
| 0x11218 |
00000000000000000000000000000000 |
................ |
| 0x11228 |
00000000000000000000000000000000 |
................ |
| 0x11238 |
00000000000000000000000000000000 |
................ |
| 0x11248 |
00000000000000000000000000000000 |
................ |
| 0x11258 |
00000000000000000000000000000000 |
................ |
| 0x11268 |
00000000000000000000000000000000 |
................ |
| 0x11278 |
00000000000000000000000000000000 |
................ |
| 0x11288 |
00000000000000000000000000000000 |
................ |
| 0x11298 |
00000000000000000000000000000000 |
................ |
| 0x112a8 |
00000000000000000000000000000000 |
................ |
| 0x112b8 |
00000000000000000000000000000000 |
................ |
| 0x112c8 |
00000000000000000000000000000000 |
................ |
| 0x112d8 |
00000000000000000000000000000000 |
................ |
| 0x112e8 |
00000000000000000000000000000000 |
................ |
| 0x112f8 |
00000000000000000000000000000000 |
................ |
| 0x11308 |
00000000000000000000000000000000 |
................ |
| 0x11318 |
00000000000000000000000000000000 |
................ |
| 0x11328 |
00000000000000000000000000000000 |
................ |
| 0x11338 |
00000000000000000000000000000000 |
................ |
| 0x11348 |
00000000000000000000000000000000 |
................ |
| 0x11358 |
00000000000000000000000000000000 |
................ |
| 0x11368 |
00000000000000000000000000000000 |
................ |
| 0x11378 |
00000000000000000000000000000000 |
................ |
| 0x11388 |
00000000000000000000000000000000 |
................ |
| 0x11398 |
00000000000000000000000000000000 |
................ |
| 0x113a8 |
00000000000000000000000000000000 |
................ |
| 0x113b8 |
00000000000000000000000000000000 |
................ |
| 0x113c8 |
0000000000 |
..... |