Static task
static1
Behavioral task
behavioral1
Sample
Groupon GmbH 14.03.2013 Rechnung.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Groupon GmbH 14.03.2013 Rechnung.exe
Resource
win10v2004-20220812-en
General
-
Target
e5f9376fb56c41b56e3a6eb5b21312a607b7c5b69e76e1f7efd92e1e8ba8c524
-
Size
44KB
-
MD5
a080cba92ee3e35bb81727062dcd3008
-
SHA1
3b19be67c0913fd691dbbb757846f550272bc140
-
SHA256
e5f9376fb56c41b56e3a6eb5b21312a607b7c5b69e76e1f7efd92e1e8ba8c524
-
SHA512
7711970cfd032e1ee3bdab3991d8d0a009f7986db7fe221d5b0e5a07474c10f2ef3a79983477e12dc17626c10eb235c5984a705e4aec0cdd80972e36d6716bb1
-
SSDEEP
768:KvuHRYrGevR5vZQxfUMVDszxrSF/KbroSKIBAU07YN1lv:KDJxZiBuWF/mEIl
Malware Config
Signatures
Files
-
e5f9376fb56c41b56e3a6eb5b21312a607b7c5b69e76e1f7efd92e1e8ba8c524.msg
-
Goupon AG Abmahnung für Marion Noack 14 März 2013.zip.zip
-
Groupon GmbH 14.03.2013 Rechnung.zip.zip
-
Groupon GmbH 14.03.2013 Rechnung.com.exe windows x86
0d1fe1f00689f8c8a204c7e750ff2801
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
RtlZeroMemory
CreateThread
lstrcpyA
WaitForSingleObject
ExitProcess
ntdll
_wcsnicmp
user32
GetActiveWindow
DispatchMessageW
GetMessageA
TranslateMessage
MessageBoxW
comdlg32
GetOpenFileNameW
shell32
ShellAboutW
powrprof
IsPwrShutdownAllowed
GetPwrCapabilities
GetActivePwrScheme
clusapi
ClusterEnum
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE