General

Malware Config

Signatures

Files

• wusa.exe

  .exe windows x64

  aacd9810a5d05d183a0138d4bdccde23

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CloseHandle

  CopyFileExW

  CreateDirectoryW

  CreateFileA

  CreateFileW

  CreateProcessW

  DeleteFileW

  ExitProcess

  FindClose

  FindFirstFileW

  FindNextFileW

  GetCommandLineW

  GetExitCodeProcess

  GetFileAttributesW

  GetModuleFileNameW

  GetModuleHandleA

  GetProcAddress

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetTempFileNameW

  GetTempPathW

  GetTickCount

  GetWindowsDirectoryW

  HeapAlloc

  HeapFree

  HeapReAlloc

  IsBadStringPtrA

  IsBadStringPtrW

  IsWow64Process

  MultiByteToWideChar

  ReadFile

  RemoveDirectoryW

  SetFilePointer

  WaitForSingleObject

  WideCharToMultiByte

  Wow64DisableWow64FsRedirection

  Wow64RevertWow64FsRedirection

  WriteFile

  ntdll

  _vsnprintf

  advapi32

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  cabinet

  FDICopy

  FDICreate

  FDIDestroy

  ole32

  CoCreateInstance

  CoInitialize

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  VariantInit

  shlwapi

  PathFileExistsW

  PathRemoveFileSpecW

  ucrtbase

  __acrt_iob_func

  __p___argc

  __p___wargv

  __stdio_common_vsprintf

  _configure_wide_argv

  _get_initial_wide_environment

  _initialize_wide_environment

  _set_app_type

  _strdup

  _wcsicmp

  exit

  free

  fwrite

  getenv

  memcmp

  memcpy

  memmove

  strchr

  strcmp

  strcpy

  strcspn

  strlen

  wcschr

  wcscmp

  wcsncmp

  wcsrchr

  wcsstr

  wcstoul

  Sections

  .text

  Size: 36KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 80B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 4KB - Virtual size: 828B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 4KB - Virtual size: 960B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 352B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  /4

  Size: 4KB - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 132KB - Virtual size: 130KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /70

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /81

  Size: 88KB - Virtual size: 84KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /92

  Size: 20KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ