General

Malware Config

Signatures

Files

• dadcbbb2166372ecd1233c3fb9b02b29

  .exe windows:4 windows x86 arch:x86

  c2e565197e385c9d09ba010f53d1f5ca

  
  

  Code Sign

  6e:d2:ef:44:b4:9e:4c:8f:4d:a7:c7:9f:37:b4:d7:a1

  Certificate

  Issuer

  CN=5U84

  Not Before

  01-06-2012 08:28

  Not After

  31-12-2039 23:59

  Subject

  CN=5U84

  Extended Key Usages

  ExtKeyUsageCodeSigning

  07:3b:c9:48:1f:64:5e:a0:c2:64:28:c8:07:5c:9c:f5:41:03:c3:04

  Signer

  Actual PE Digest

  07:3b:c9:48:1f:64:5e:a0:c2:64:28:c8:07:5c:9c:f5:41:03:c3:04

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetWindowsDirectoryW

  lstrcatW

  CreateFileW

  VirtualAllocEx

  CloseHandle

  GetModuleHandleW

  GetProcAddress

  user32

  GetDC

  ReleaseDC

  InvalidateRect

  BeginPaint

  ScrollWindow

  EndPaint

  PostQuitMessage

  DefWindowProcA

  gdi32

  GetStockObject

  SelectObject

  GetTextMetricsA

  SetBkMode

  TextOutA

  advapi32

  RegCloseKey

  Sections

  .text

  Size: 53KB - Virtual size: 53KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 109KB - Virtual size: 109KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data5

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data4

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data3

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data2

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 280B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ