d7bf6978bf504dbe448ec4e4e18b25fb89cecf62541923622d282b9bfbe5605f

Sharing

Copy URL Twitter E-mail

General

Target

d7bf6978bf504dbe448ec4e4e18b25fb89cecf62541923622d282b9bfbe5605f
Size

146KB
MD5

55dbf6f85124346ded8849a5637c2ffc
SHA1

26bcef34eafb879bf378307cbb304a9f3e3441be
SHA256

d7bf6978bf504dbe448ec4e4e18b25fb89cecf62541923622d282b9bfbe5605f
SHA512

7f4b72d29936ba7f70bab2e70ae451c6c0b3c2651ca8b5a37d9aa03c161ba09e685a9e7265136e2bed6748f84b68aa3ec869e67d55e1ad98670a1c4e7a38554c
SSDEEP

3072:wuL4suyftDcmLDLYYJQEIigwkZM7QWtcJWjRzvNNcIdlwC09BJQB:wuL48ftDcmHz7PgDZJkjRzVOqnUMB

Score

N/A

Malware Config

Signatures

Files

d7bf6978bf504dbe448ec4e4e18b25fb89cecf62541923622d282b9bfbe5605f
.zip
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
.exe windows x86

ba5a3baf4c2758c3fc0e435746b2287c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_SetImageCount
InitCommonControls
ImageList_Duplicate
UninitializeFlatSB
DrawStatusText
DrawStatusTextW
ImageList_LoadImageW
InitCommonControlsEx
FlatSB_GetScrollProp
ImageList_Create

dsprop

DllUnregisterServer
ErrMsgParam
BringSheetToForeground
ADsPropGetInitInfo
IsSheetAlreadyUp

dciman32

WinWatchGetClipList
DCICreateOffscreen
DCIEnum
DCIOpenProvider
WinWatchDidStatusChange
DCISetClipList
WinWatchNotify
DCICreatePrimary
DCICreateOverlay
DCISetDestination
DCISetSrcDestClip
WinWatchOpen
DCIDraw
WinWatchClose
GetDCRegionData
GetWindowRegionData
DCIEndAccess
DCIDestroy

gdi32

CloseMetaFile
CreatePen
CreatePenIndirect
STROBJ_bEnumPositionsOnly
DeleteObject
GetStockObject
CreateBrushIndirect
CreateSolidBrush
EqualRgn
SelectObject
GetEUDCTimeStamp
CreatePalette
CreateFontIndirectA

rasser

PortClearStatistics
PortSend
PortSetINetCfg
PortSetInfo
PortConnect
PortEnum
PortGetStatistics
PortClose
PortSetFraming
PortReceive
PortCompressionSetInfo
PortDisconnect
PortTestSignalState
PortGetPortState
PortChangeCallback
PortOpen

winscard

SCardForgetCardTypeW
SCardForgetReaderW
SCardReleaseStartedEvent
SCardReleaseNewReaderEvent
SCardAddReaderToGroupA
SCardLocateCardsW
SCardFreeMemory
SCardForgetReaderGroupA
SCardControl
SCardGetStatusChangeA
SCardCancel
SCardGetCardTypeProviderNameA
SCardGetAttrib
SCardTransmit

oleaut32

VarBoolFromDec
DllUnregisterServer
GetActiveObject
VarCySub
VariantCopy
VarUI2FromCy
VarFormatNumber
VarI4FromUI2
SafeArrayGetVartype
VarUI2FromBool
VarCyCmp
VarCmp
VarCyFromI1
VarUI4FromUI2
VarI1FromDate
VarUI4FromDate
VarXor
VarR4CmpR8

user32

LoadIconA
FindWindowW
GetForegroundWindow
LoadBitmapW
LoadCursorA
LoadAcceleratorsW
GetSystemMetrics
LoadMenuW
LoadBitmapA
FindWindowA
IsChild
GetDesktopWindow
GetSysColorBrush
GetClientRect
GetMenu
LoadMenuA
GetWindowRect
GetDC
GetProcessDefaultLayout
LoadAcceleratorsA
GetWindowTextA
GetWindowTextW
GetSysColor

glu32

gluQuadricNormals
gluTessNormal
gluDisk
gluNurbsSurface
gluTessEndPolygon
gluTessCallback
gluDeleteNurbsRenderer
gluErrorString
gluNurbsCurve
gluNewQuadric
gluScaleImage
gluTessBeginContour
gluBeginTrim
gluQuadricTexture
gluEndSurface
gluBeginCurve

iasnap

DllRegisterServer
DllCanUnloadNow
DllUnregisterServer
DllGetClassObject

kernel32

GetStartupInfoW
CloseHandle
GetProcAddress
GetFileAttributesW
CopyFileA
VirtualAlloc
LoadLibraryA
GetCommandLineA
CreateEventA
AddAtomW

imm32

ImmCreateContext
ImmDisableIME
ImmGetCompositionFontW
ImmSetCompositionFontA
ImmGetIMCCSize
ImmGetOpenStatus
ImmIMPQueryIMEW
ImmGetImeMenuItemsA
ImmGetConversionListA
ImmAssociateContext
ImmIMPGetIMEA
ImmGetConversionListW
ImmGetIMEFileNameA
ImmGetCandidateListCountA
ImmRegisterClient
ImmIsUIMessageW

ole32

HMENU_UserFree
CoUninitialize
OleCreateStaticFromData
SetErrorInfo
CoInitialize
CoTaskMemFree
OleCreateFromDataEx

shlwapi

StrStrIA
StrCSpnW
PathStripToRootA
StrStrA
StrCSpnA
PathGetDriveNumberW
PathFindFileNameA
StrTrimA
PathSkipRootW
PathStripToRootW
PathRemoveExtensionW
PathStripPathW
StrCmpW
PathRemoveBlanksA
PathRemoveExtensionA

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba5a3baf4c2758c3fc0e435746b2287c

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

dsprop

dciman32

gdi32

rasser

winscard

oleaut32

user32

glu32

iasnap

kernel32

imm32

ole32

shlwapi

Sections

.text Size: 157KB - Virtual size: 157KB

/14 Size: 512B - Virtual size: 152B

.data Size: 4KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 5KB

.text
Size: 157KB - Virtual size: 157KB

/14
Size: 512B - Virtual size: 152B

.data
Size: 4KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 5KB