202c87b0ce8310572abf72291f76b1ac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

202c87b0ce8310572abf72291f76b1ac
Size

629KB
MD5

202c87b0ce8310572abf72291f76b1ac
SHA1

a8f8d021fd049d685575028477c0af5f0258072f
SHA256

c64d14275c06014879aa83969c632627bcbd90662b9a311d6d59e48e01cdbbd0
SHA512

2614980d3ed3db095635bb200065e622bddf84effb7ba4497e0fda953c9e6e45c3f1c99dd24d3cf235756d4a9cae2bb782aef13fd78860ae6312310825f9cbcd
SSDEEP

12288:bK2yBOGkekaNuivcQyk21dR2dfnhXHEdxFEY/ofHtKTrZ8uR:bKmna9vny7wVpHEd8f0iuR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/043678861244957420735422051745-Rechnung.com

Files

202c87b0ce8310572abf72291f76b1ac
.zip
043678861244957420735422051745-Rechnung.com
.exe windows:5 windows x86 arch:x86

9786005b2181dd873bcdc02fe9c0971e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ctl3d32

Ctl3dRegister
Ctl3dCtlColor
Ctl3dUnregister
Ctl3dEnabled
Ctl3dGetVer

kernel32

FindResourceExW
VirtualAllocEx
SetErrorMode
VirtualQueryEx
GetTickCount
GetDriveTypeW
OpenSemaphoreW
GetVolumeInformationW
HeapAlloc
FindFirstFileA
LoadLibraryA
CreateSemaphoreA
TlsGetValue
CreateFileW
LoadLibraryW

advapi32

RegRestoreKeyW
RegSaveKeyW
CryptSignHashA
ReadEventLogA
ControlService
RegUnLoadKeyA
RegLoadKeyA
RegDeleteValueW
CloseTrace
IsTextUnicode
RegReplaceKeyA
IsValidSid

modemui

drvSetDefaultCommConfigA
CountryRunOnce
drvCommConfigDialogA
InvokeControlPanel
drvGetDefaultCommConfigA

Sections

.text
Size: 650KB - Virtual size: 649KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ