Static task
static1
Behavioral task
behavioral1
Sample
Telekom April Rechnung T828981 6665593900 08 05 23 pdf .exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Telekom April Rechnung T828981 6665593900 08 05 23 pdf .exe
Resource
win10v2004-20230220-en
General
-
Target
Telekom April Rechnung T828981 6665593900 08 05 23 pdf .exe
-
Size
947KB
-
MD5
4168062e29d34561bf09ef937778473b
-
SHA1
3af15b725351027352c3742041fe8e5a1f923b24
-
SHA256
18bd7e0025cf470a6250fb291a5ef3041edb51ad41290ee415e1841ebba4208b
-
SHA512
c171ee22c9c91eff178d2911f5eb3a5c4a28f955d561d742601b3ab35ec2cafa145d1b340beeb612ade43a2ad24467e060f3dac7f29c021ed377c409f2689dff
-
SSDEEP
12288:Z3QP8W7YEs04dBSDQDDI6pJ7sIeFVo3v8rs4am4qRRYauCP7r9r/+ppppppppppK:Z3QP8EYEs047GeDI6pB2oErs4mrax1qQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Telekom April Rechnung T828981 6665593900 08 05 23 pdf .exe
Files
-
Telekom April Rechnung T828981 6665593900 08 05 23 pdf .exe.exe windows x86
ae64f100c0f22c43c95a1d2055ef681a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoW
WriteConsoleA
LoadLibraryA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
GetCurrentProcess
GetVersion
GetModuleHandleA
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetProcAddress
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetCPInfo
GetLastError
HeapFree
LCMapStringA
LCMapStringW
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
HeapSize
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
CloseHandle
user32
GetClassInfoA
CallWindowProcA
SetWindowLongA
IsDlgButtonChecked
SetWindowTextA
CheckDlgButton
GetActiveWindow
LoadCursorA
MessageBoxA
wsprintfA
GetDlgItemTextA
gdi32
GetStockObject
DeleteObject
SetBkMode
SetTextColor
CreateFontIndirectA
SelectObject
GetObjectA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegDeleteKeyA
Sections
.text Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 595KB - Virtual size: 602KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ