General

Malware Config

Signatures

Files

• df9b700afe7baecd365281850ee52c93

  .exe windows:4 windows x86 arch:x86

  71c85ad40be74518ec557514870f1ac1

  
  

  Code Sign

  1e:6f:f8:01:8a:9c:0e:97:44:1b:87:62:1f:06:ee:ee

  Certificate

  Issuer

  CN=mkbU

  Not Before

  29-05-2012 05:34

  Not After

  31-12-2039 23:59

  Subject

  CN=mkbU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  84:e8:1b:d8:5e:cd:c6:99:53:e6:b8:67:34:40:0b:1b:72:1d:ee:08

  Signer

  Actual PE Digest

  84:e8:1b:d8:5e:cd:c6:99:53:e6:b8:67:34:40:0b:1b:72:1d:ee:08

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetWindowsDirectoryW

  lstrcatW

  CreateFileW

  VirtualAllocEx

  CloseHandle

  WriteFile

  GetModuleHandleW

  GetProcAddress

  user32

  GetDC

  ReleaseDC

  InvalidateRect

  BeginPaint

  ScrollWindow

  wsprintfA

  ValidateRect

  EndPaint

  PostQuitMessage

  DefWindowProcA

  gdi32

  GetStockObject

  SelectObject

  GetTextMetricsA

  SetBkMode

  TextOutA

  advapi32

  RegCloseKey

  Sections

  .text

  Size: 53KB - Virtual size: 53KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 108KB - Virtual size: 108KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data4

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data3

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data2

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 328B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ