General

Malware Config

Signatures

Files

• f9a32857-c23f-4d9e-94ec-c2298dd2659c.zip

  .zip

  Password: 684802

• SCAN_SP0692.img

  .iso

  Password: 684802

• Invoice/CancelledInvoice.txt
• Invoice/Contract.sm

  .dll windows x86

  Password: 684802

  d0ce5a8d5d0f4fa36cbdd8035bad1ebc

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  DebugBreak

  GetCommandLineA

  GetVersion

  RtlUnwind

  HeapFree

  GetLastError

  CloseHandle

  WriteFile

  ReadFile

  ExitProcess

  TerminateProcess

  GetCurrentProcess

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  HeapAlloc

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameA

  GetEnvironmentVariableA

  GetVersionExA

  HeapDestroy

  HeapCreate

  VirtualFree

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStrings

  GetEnvironmentStringsW

  MultiByteToWideChar

  GetStringTypeA

  GetStringTypeW

  VirtualAlloc

  HeapReAlloc

  IsBadWritePtr

  SetStdHandle

  FlushFileBuffers

  SetFilePointer

  CreateFileA

  GetCPInfo

  GetACP

  GetOEMCP

  LoadLibraryA

  SetEndOfFile

  LCMapStringA

  LCMapStringW

  GlobalMemoryStatus

  GetTickCount

  FindFirstFileA

  OpenFile

  lstrcpynA

  GetDriveTypeA

  IsDBCSLeadByte

  lstrlenA

  GetFileAttributesA

  _lclose

  _llseek

  _lread

  _lwrite

  DeleteFileA

  FreeLibrary

  GetDiskFreeSpaceA

  GetTempFileNameA

  GetTempPathA

  lstrcatA

  lstrcpyA

  FindClose

  CompareStringA

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  FindNextFileA

  CreateDirectoryA

  RemoveDirectoryA

  SetEnvironmentVariableA

  CompareStringW

  IsDBCSLeadByteEx

  MoveFileA

  GetTimeZoneInformation

  GetSystemTime

  GetLocalTime

  HeapCompact

  RaiseException

  GetCurrentProcessId

  SetUnhandledExceptionFilter

  IsBadReadPtr

  IsBadCodePtr

  user32

  MessageBoxA

  CharUpperBuffA

  CharToOemBuffA

  OemToCharBuffA

  GetActiveWindow

  mpr

  WNetEnumResourceA

  WNetCloseEnum

  WNetGetConnectionA

  WNetOpenEnumA

  WNetAddConnection2A

  Exports

  Exports

  TDFAddDocJavaScript

  TDFAddTemplate

  TDFClose

  TDFCreate

  TDFEmbedAndClose

  TDFEnumValues

  TDFExtractAppendSaves

  TDFExtractAttachment

  TDFGetAP

  TDFGetEncoding

  TDFGetFDFVersion

  TDFGetFile

  TDFGetFlags

  TDFGetID

  TDFGetNthValue

  TDFGetOpt

  TDFGetStatus

  TDFGetValue

  TDFGetVersion

  TDFNextFieldName

  TDFOpen

  TDFOpenFromEmbedded

  TDFRemoveItem

  TDFSave

  TDFSetAP

  TDFSetAPRef

  TDFSetAS

  TDFSetEncoding

  TDFSetFDFVersion

  TDFSetFile

  TDFSetFileEx

  TDFSetFlags

  TDFSetGoToAction

  TDFSetGoToRAction

  TDFSetHideAction

  TDFSetID

  TDFSetIF

  TDFSetImportDataAction

  TDFSetJavaScriptAction

  TDFSetNamedAction

  TDFSetOnImportJavaScript

  TDFSetOpt

  TDFSetResetByNameAction

  TDFSetResetFormAction

  TDFSetStateAction

  TDFSetStatus

  TDFSetSubmitByNameAction

  TDFSetSubmitFormAction

  TDFSetTargetFrame

  TDFSetURIAction

  TDFSetValue

  Updt

  Sections

  .text

  Size: 324KB - Virtual size: 323KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 24KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 36KB - Virtual size: 47KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 124KB - Virtual size: 123KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Invoice/Document.txt
• Invoice/Information.txt
• Invoice/LASTInformation.txt
• Invoice/Updates.txt
• Invoice/YouContract.cmd
• SCAN_SP0692.lnk

  .lnk