General

Malware Config

Signatures

Files

• 0a4e185a7b4a46ecd1a305b1dada207f845bd8a252b3458f9c4f722c82653611

  .zip
• rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

  .exe windows x86

  a5baacb5688137cc035876f830f3edc5

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mfc42u

  ord2116

  ord5273

  ord2977

  ord3142

  ord3254

  ord4459

  ord3131

  ord3257

  ord2980

  ord3076

  ord2971

  ord3825

  ord3826

  ord3820

  ord3074

  ord4075

  ord4621

  ord4419

  ord3592

  ord800

  ord641

  ord861

  ord540

  ord324

  ord2362

  ord4229

  ord6195

  ord3087

  ord4704

  ord4847

  ord6330

  ord825

  ord3805

  ord2361

  ord2291

  ord535

  ord860

  ord922

  ord537

  ord823

  ord2293

  ord3614

  ord3621

  ord3658

  ord2406

  ord665

  ord1971

  ord3313

  ord5180

  ord354

  ord1834

  ord4237

  ord2715

  ord2382

  ord3054

  ord5094

  ord5097

  ord4461

  ord4298

  ord3345

  ord5006

  ord975

  ord5468

  ord3398

  ord2874

  ord2873

  ord4146

  ord6051

  ord4072

  ord1768

  ord5233

  ord5278

  ord2641

  ord1658

  ord4430

  ord4421

  ord674

  ord529

  ord366

  ord796

  ord5996

  ord2109

  ord4451

  ord5248

  ord4606

  ord4604

  ord4269

  ord6371

  ord4480

  ord2546

  ord2504

  ord5727

  ord3917

  ord1089

  ord5193

  ord2388

  ord2438

  ord5296

  ord5298

  ord4074

  ord4692

  ord5303

  ord5285

  ord5710

  ord4616

  ord4418

  ord3733

  ord815

  ord561

  ord6211

  ord617

  ord5297

  ord5208

  ord296

  ord986

  ord520

  ord4154

  ord6113

  ord2613

  ord1131

  ord2717

  ord1817

  ord4233

  ord4690

  ord3053

  ord3060

  ord6332

  ord2502

  ord2534

  ord5239

  ord5736

  ord1739

  ord5573

  ord3167

  ord5649

  ord4414

  ord4947

  ord4852

  ord2391

  ord4381

  ord3449

  ord3193

  ord6076

  ord6171

  ord4617

  ord4420

  ord338

  ord652

  ord4817

  ord1937

  ord4268

  ord4583

  ord4582

  ord4893

  ord4364

  ord4886

  ord5070

  ord4335

  ord4343

  ord4884

  ord4525

  ord4539

  ord4537

  ord4520

  ord4523

  ord4518

  ord4958

  ord4955

  ord4103

  ord5236

  ord5286

  ord3743

  ord1719

  ord4426

  ord693

  ord813

  ord560

  ord795

  ord5256

  ord858

  ord3296

  ord1197

  ord2092

  ord2108

  ord4717

  ord3397

  ord3716

  ord567

  ord2574

  ord4396

  ord3365

  ord3635

  ord1569

  ord5257

  ord1720

  ord5059

  ord3744

  ord6372

  ord2047

  ord2640

  ord4435

  ord4831

  ord3793

  ord5276

  ord4347

  ord6370

  ord5157

  ord2377

  ord5237

  ord4401

  ord1767

  ord4073

  ord6048

  ord2506

  ord4992

  ord4370

  ord3341

  ord5261

  ord1165

  msvcrt

  _controlfp

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  __CxxFrameHandler

  memcpy

  fopen

  strcat

  wcscmp

  _exit

  _XcptFilter

  _CxxThrowException

  wcslen

  exit

  _wcmdln

  _initterm

  __wgetmainargs

  kernel32

  GetTimeFormatA

  DeleteFileA

  ClearCommBreak

  GetProcAddress

  SetCommBreak

  OpenProcess

  GetCurrentProcessId

  GetModuleHandleW

  GetStartupInfoW

  InterlockedDecrement

  GetModuleFileNameA

  GetLocaleInfoA

  FreeEnvironmentStringsW

  GetLastError

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  LocalFree

  GetSystemInfo

  user32

  SendMessageA

  GetMessageW

  CheckMenuItem

  BeginPaint

  SendMessageW

  RegisterClipboardFormatW

  ShowCursor

  GetClientRect

  UpdateWindow

  EnableWindow

  gdi32

  TextOutW

  GetCharWidthW

  DeleteObject

  oleaut32

  VariantInit

  SysFreeString

  VariantCopy

  SysAllocString

  VariantClear

  VariantChangeType

  GetErrorInfo

  psapi

  GetModuleFileNameExW

  Sections

  .text

  Size: 32KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 980KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .eee

  Size: 12KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 132KB - Virtual size: 130KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ