Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
Resource
win10v2004-20220812-en
General
-
Target
28be5dd5b1b1d56e7da71b91db0c40a9c609be7daea1f2bb51baf75d3ada28d5
-
Size
134KB
-
MD5
52693dc8f65e3af4e6602dcbd46ef59b
-
SHA1
21b02c39ccf03b9464cb5bd42857e6039deea8be
-
SHA256
28be5dd5b1b1d56e7da71b91db0c40a9c609be7daea1f2bb51baf75d3ada28d5
-
SHA512
3e6b217bd23bb23e23513c6223411cb6d3095508c2f23b108e3451b6751ae4d65bd6950686c1a3a5713b97b9ba9474dedef9141dd04cd91f1b75f0a72a973cf2
-
SSDEEP
3072:jG8ouV2qjrOpIAFjGylI9sMJF99JEro9qcbi5h7:bV7Pzq1lI9sMJFj4oLbSh7
Malware Config
Signatures
Files
-
28be5dd5b1b1d56e7da71b91db0c40a9c609be7daea1f2bb51baf75d3ada28d5.zip
-
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe.exe windows x86
bcdc7ff93bc34eb6f3798d235d2e4142
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenFile
VirtualAlloc
GlobalUnfix
WaitCommEvent
ReadConsoleW
GetConsoleInputExeNameA
GetConsoleKeyboardLayoutNameA
GetConsoleAliasExesLengthA
SetConsoleDisplayMode
lstrcpynA
Module32NextW
LocalFileTimeToFileTime
GetACP
gdi32
CreateSolidBrush
ExtSelectClipRgn
TextOutW
EqualRgn
CreateBrushIndirect
DeleteObject
HT_Get8BPPFormatPalette
GetStockObject
CreatePalette
CreatePenIndirect
SelectObject
StartPage
CreateFontIndirectA
GetClipBox
CreatePen
user32
LoadCursorA
LoadMenuW
GetDC
GetClientRect
IsChild
LoadBitmapW
FindWindowW
FindWindowA
GetMenu
LoadBitmapA
GetSystemMetrics
dmocx
DllCanUnloadNow
DllUnregisterServer
DllRegisterServer
DllGetClassObject
iasrad
?initialize@VSAFilter@@QAEJXZ
?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
DllUnregisterServer
DllRegisterServer
DllGetClassObject
?shutdown@VSAFilter@@QAEJXZ
DllCanUnloadNow
wshext
DllGetClassObject
PutSignedDataMsg
IsFileSupportedName
DllCanUnloadNow
DllUnregisterServer
CreateIndirectData
VerifyIndirectData
RemoveSignedDataMsg
GetSignedDataMsg
DllRegisterServer
comctl32
InitCommonControlsEx
CreateStatusWindowW
ImageList_AddMasked
ImageList_SetFilter
ImageList_Replace
InitializeFlatSB
FlatSB_SetScrollRange
InitCommonControls
PropertySheet
ImageList_Read
ImageList_Create
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 764B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ