General

Malware Config

Signatures

Files

• dc581035e34ba6e83a94e7075375be11

  .exe windows:4 windows x86 arch:x86

  e291a67fb71949b4eaf40ae126c446ce

  
  

  Code Sign

  74:ad:18:6e:e7:4a:e9:6f:b9:70:52:ca:32:f6:f9:b4

  Certificate

  Issuer

  CN=xdWp

  Not Before

  05-06-2012 05:33

  Not After

  31-12-2039 23:59

  Subject

  CN=xdWp

  Extended Key Usages

  ExtKeyUsageCodeSigning

  9f:30:b2:1d:ed:a0:3c:89:56:a4:54:f3:39:9f:cc:9e:1a:01:8a:99

  Signer

  Actual PE Digest

  9f:30:b2:1d:ed:a0:3c:89:56:a4:54:f3:39:9f:cc:9e:1a:01:8a:99

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ReadFile

  LoadLibraryA

  GetProcAddress

  GetWindowsDirectoryW

  lstrcatW

  CreateFileW

  VirtualAllocEx

  CloseHandle

  user32

  GetDC

  ReleaseDC

  InvalidateRect

  BeginPaint

  ScrollWindow

  EndPaint

  PostQuitMessage

  DefWindowProcA

  gdi32

  GetStockObject

  SelectObject

  GetTextMetricsA

  SetBkMode

  TextOutA

  advapi32

  RegCloseKey

  Sections

  .text

  Size: 32KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 91KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data4

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data3

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data2

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 300B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ