General

Malware Config

Signatures

Files

• bc788819e908bee0ffa9973a3186ed2c0e641a7bdaff2d165cfd9e92d9a40dd4

  .zip
• rechnung_11_2014_vodafone_team_00200034994_00003999300067_11_0000002738.exe

  .exe windows x86

  bcdc7ff93bc34eb6f3798d235d2e4142

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  OpenFile

  VirtualAlloc

  GlobalUnfix

  WaitCommEvent

  ReadConsoleW

  GetConsoleInputExeNameA

  GetConsoleKeyboardLayoutNameA

  GetConsoleAliasExesLengthA

  SetConsoleDisplayMode

  lstrcpynA

  Module32NextW

  LocalFileTimeToFileTime

  GetACP

  gdi32

  CreateSolidBrush

  ExtSelectClipRgn

  TextOutW

  EqualRgn

  CreateBrushIndirect

  DeleteObject

  HT_Get8BPPFormatPalette

  GetStockObject

  CreatePalette

  CreatePenIndirect

  SelectObject

  StartPage

  CreateFontIndirectA

  GetClipBox

  CreatePen

  user32

  LoadCursorA

  LoadMenuW

  GetDC

  GetClientRect

  IsChild

  LoadBitmapW

  FindWindowW

  FindWindowA

  GetMenu

  LoadBitmapA

  GetSystemMetrics

  dmocx

  DllCanUnloadNow

  DllUnregisterServer

  DllRegisterServer

  DllGetClassObject

  iasrad

  ?initialize@VSAFilter@@QAEJXZ

  ?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z

  DllUnregisterServer

  DllRegisterServer

  DllGetClassObject

  ?shutdown@VSAFilter@@QAEJXZ

  DllCanUnloadNow

  wshext

  DllGetClassObject

  PutSignedDataMsg

  IsFileSupportedName

  DllCanUnloadNow

  DllUnregisterServer

  CreateIndirectData

  VerifyIndirectData

  RemoveSignedDataMsg

  GetSignedDataMsg

  DllRegisterServer

  comctl32

  InitCommonControlsEx

  CreateStatusWindowW

  ImageList_AddMasked

  ImageList_SetFilter

  ImageList_Replace

  InitializeFlatSB

  FlatSB_SetScrollRange

  InitCommonControls

  PropertySheet

  ImageList_Read

  ImageList_Create

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 216B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 170KB - Virtual size: 169KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 764B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ