Static task
static1
Behavioral task
behavioral1
Sample
Groupon GmbH 14.03.2013 Rechnung.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Groupon GmbH 14.03.2013 Rechnung.exe
Resource
win10v2004-20220812-en
General
-
Target
5832b1a78f6a5218d0639f16b67a87d57e57fe9f92622fd59d58ce87c2b68c16
-
Size
20KB
-
MD5
042bc80cc2684e87acc3c95892f171b2
-
SHA1
ba535cbaaa85d3367dbe59f81be466e48bc9b931
-
SHA256
5832b1a78f6a5218d0639f16b67a87d57e57fe9f92622fd59d58ce87c2b68c16
-
SHA512
b0694a2281630dd50867e9aed5905d9569d270f7781795093b66a69714ec389ba2ac07195a8a37361b2aa713364e48fc01ccc31ea25a7dc73698c649e38b9c2e
-
SSDEEP
384:713/bs+n+HBrr10F/KycT72ogwoSZH5RMIit5SAuz07YN1pJiDW5dpr9xJ2:7VDszxrSF/KbroSKIBAU07YN1lvQ
Malware Config
Signatures
Files
-
5832b1a78f6a5218d0639f16b67a87d57e57fe9f92622fd59d58ce87c2b68c16.zip
-
Groupon GmbH 14.03.2013 Rechnung.zip.zip
-
Groupon GmbH 14.03.2013 Rechnung.com.exe windows x86
0d1fe1f00689f8c8a204c7e750ff2801
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
RtlZeroMemory
CreateThread
lstrcpyA
WaitForSingleObject
ExitProcess
ntdll
_wcsnicmp
user32
GetActiveWindow
DispatchMessageW
GetMessageA
TranslateMessage
MessageBoxW
comdlg32
GetOpenFileNameW
shell32
ShellAboutW
powrprof
IsPwrShutdownAllowed
GetPwrCapabilities
GetActivePwrScheme
clusapi
ClusterEnum
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE