4a149f5d51caeb810fd77a159c15bf2028833f8de9f76571ecd6aff8a1974f20

Sharing

Copy URL Twitter E-mail

General

Target

4a149f5d51caeb810fd77a159c15bf2028833f8de9f76571ecd6aff8a1974f20
Size

455KB
MD5

3617a3a0f293afa2bb23fdaa1582ed30
SHA1

7d3f4e89c52fa9ac21afd86ccdd98d5b0f119c3b
SHA256

4a149f5d51caeb810fd77a159c15bf2028833f8de9f76571ecd6aff8a1974f20
SHA512

3c6cd696f62cc7e3df33d1372ce813542ee0cd29bd5d85110162dc6020ad44ac4f61b060ac116f91c06348b7f0c0a96001227f241fe1ebf42bfd09a11b32de37
SSDEEP

12288:f4SWWc7Wagc+7NWydOYuO70qr/tmlGG6/eLEO:QS7c7dg7A+70qrEpceYO

Score

1^/10

Malware Config

Signatures

Files

4a149f5d51caeb810fd77a159c15bf2028833f8de9f76571ecd6aff8a1974f20
.exe windows:5 windows x86 arch:x86

6b4b63473f244397f49d81efa1b3e9c5

Code Sign

9c:c6
Certificate

Issuer

SERIALNUMBER=16,CN=eSignature Basic,OU=eSignature Basic,O=Telekom Austria AG,C=AT

Not Before

22/02/2010, 09:24

Not After

22/02/2015, 15:24

Subject

SERIALNUMBER=40134,CN=Christine Foitik,C=AT,1.2.840.113549.1.9.1=#0c0f6e6f74617240666f6974696b2e6174

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement

61:b9:d9:cb:a1:87:37:e1:ec:a1:04:42:5d:a6:ba:b5:bc:36:4e:f3
Signer

Actual PE Digest

61:b9:d9:cb:a1:87:37:e1:ec:a1:04:42:5d:a6:ba:b5:bc:36:4e:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
OutputDebugStringA
GetWindowsDirectoryW
GetVersion
GetCurrentProcessId
GetSystemTime
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapSize
GetModuleHandleA
GetLocaleInfoA
GetStringTypeW
VirtualAlloc
GetLastError
lstrlenW
WriteConsoleW
GetSystemDirectoryW
VirtualFree
GetTickCount
GetModuleHandleW
GetCPInfo
GetStringTypeA
GetConsoleOutputCP
GetCommandLineW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW

user32

GetWindowRect
LoadCursorW
GetForegroundWindow
GetWindowTextA
GetWindowLongW
GetWindowTextW
IsWindowUnicode
GetDesktopWindow
GetCursor
IsWindowVisible
GetMessageTime
GetMessagePos

advapi32

RegOpenKeyExW
RegOpenKeyExA
GetUserNameW
GetUserNameA

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b4b63473f244397f49d81efa1b3e9c5

Code Sign

9c:c6Certificate

Key Usages

61:b9:d9:cb:a1:87:37:e1:ec:a1:04:42:5d:a6:ba:b5:bc:36:4e:f3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 353KB - Virtual size: 353KB

9c:c6
Certificate

61:b9:d9:cb:a1:87:37:e1:ec:a1:04:42:5d:a6:ba:b5:bc:36:4e:f3
Signer

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 353KB - Virtual size: 353KB