wscore[.]exe | Triage

Resubmissions

21-12-2022 12:35

221221-psfmcacc49 1

21-12-2022 12:34

221221-prtskscc48 1

Sharing

Copy URL

Twitter E-mail

General

Target

wscore.exe
Size

6.1MB
MD5

8f37a1f006802141b97cbf8d6f679960
SHA1

853c4180aa3f4bb27ad7b1e9f81f1bce337704c0
SHA256

95b468ae41587955e093d99bce0a57a704006e51d455a7bd23baa3d49ad669d1
SHA512

d6bfd9d8f0136ba180d151f42c8839b7ce487c91eeda113f8db233fb9f5311167d7f85a5c9a15efd9b8d421aa965e0d7107cc63b6cabd902aa851fe3c88a2e8c
SSDEEP

49152:JUJMRytVpuFSLWeZHjuUuYQU029qy+E+mOV/Oz9:7RytVp/WGjuUuOpOJOh

Score

N/A

Malware Config

Signatures

Files

wscore.exe
.exe windows x86

a21a945a9cdde74bbd23bc411579dd48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

mmioSeek
midiStreamClose
midiOutUnprepareHeader
midiOutGetNumDevs
midiOutGetDevCapsA
midiInGetNumDevs
midiInGetDevCapsA
midiInGetErrorTextA
midiInOpen
midiInStart
mciGetErrorStringA
mmioOpenA
mmioDescend
midiOutShortMsg
mmioRead
mmioClose
midiStreamPosition
midiStreamStop
midiStreamPause
midiStreamRestart
midiOutReset
midiStreamOpen
midiStreamProperty
midiOutPrepareHeader
midiStreamOut

kernel32

SetFileTime
FileTimeToSystemTime
FindClose
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
_lclose
_lread
_lopen
GetSystemDirectoryA
lstrlenA
CloseHandle
WriteFile
CreateFileA
LocalAlloc
GlobalHandle
GlobalReAlloc
Sleep
LocalFree
lstrcpyA
MulDiv
LocalLock
LocalUnlock
LocalReAlloc
GetModuleHandleA
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetProcAddress
HeapReAlloc
HeapAlloc
TerminateProcess
GetCurrentProcess
HeapSize
HeapFree
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetLastError
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetFileAttributesA
SetFileAttributesA
SetFilePointer
SetEndOfFile
GetLocalTime
SetErrorMode
Beep
GetVersionExA
SetLocalTime
SystemTimeToFileTime
FileTimeToLocalFileTime
GetProcessTimes
FormatMessageA
DebugBreak
RaiseException
FreeLibrary
SetLastError
GetCurrentThread
VirtualQuery
MapViewOfFile
CreateFileMappingA
ReadFile
GetTempFileNameA
GetTempPathA
GetFullPathNameA
GetFileInformationByHandle
DeleteFileA
WaitForSingleObject
SetThreadPriority
CreateProcessA
FlushFileBuffers
SetCurrentDirectoryA
ReleaseSemaphore
ResumeThread
SuspendThread
TlsSetValue
GetExitCodeProcess
DuplicateHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemTime
CompareStringA
SetEnvironmentVariableW
WriteConsoleA
GetTimeZoneInformation
SetStdHandle
GetSystemTimeAsFileTime
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
RemoveDirectoryA
CreateDirectoryA
SetEnvironmentVariableA
GetDriveTypeA
GetCurrentDirectoryA
GetLogicalDrives
GetDiskFreeSpaceA
MoveFileA
FindFirstFileA
FindNextFileA
CompareStringW
LocalFileTimeToFileTime

mfc42d

ord4064
ord1344
ord4191
ord1830
ord1631
ord4205
ord2340
ord2481
ord2584
ord3691
ord2473
ord2585
ord2341
ord2432
ord2339
ord3143
ord3144
ord3142
ord2431
ord3367
ord3786
ord3658
ord1952
ord1228
ord4492
ord2875
ord317
ord728
ord574
ord1857
ord3524
ord2069
ord3831
ord3629
ord3173
ord2435
ord4934
ord730
ord719
ord1434
ord3533
ord4079
ord1609
ord2103
ord1784
ord2412
ord4078
ord4082
ord3692
ord3575
ord2680
ord4021
ord974
ord4279
ord2717
ord2223
ord2222
ord3430
ord4756
ord3361
ord1365
ord4174
ord1779
ord4211
ord2077
ord1309
ord3666
ord1829
ord3661
ord391
ord599
ord4185
ord1258
ord1990
ord4268
ord2682
ord3784
ord3657
ord5051
ord1042
ord3382
ord1041
ord3369
ord1048
ord2316
ord4589
ord4861
ord1869
ord3623
ord3341
ord4278
ord3391
ord1783
ord4069
ord1324
ord1328
ord4754
ord4172
ord5074
ord4207
ord4180
ord1828
ord1949
ord1225
ord2876
ord575
ord320
ord1757
ord3525
ord1592
ord3813
ord684
ord880
ord945
ord485
ord4216
ord2024
ord1288
ord2885
ord335
ord586
ord3553
ord5065
ord3002
ord1098
ord1136
ord3845
ord2229
ord1087
ord3637
ord4437
ord2068
ord4837
ord1109
ord5078
ord4582
ord2302
ord4951
ord1855
ord2054
ord3450
ord1866
ord426
ord4832
ord3477
ord2329
ord1861
ord305
ord1596
ord347
ord717
ord4653
ord885
ord4952
ord474
ord2324
ord877
ord454
ord421
ord888
ord4835
ord470
ord422
ord2448
ord3427
ord3442
ord1883
ord2409
ord2426
ord1863
ord343
ord2230
ord3862
ord2384
ord1021
ord2979
ord517
ord698
ord3547
ord3802
ord3806
ord4081
ord2679
ord973
ord697
ord516
ord1179
ord4183
ord3677
ord1435
ord3534
ord3167
ord1636
ord1785
ord4080
ord4083
ord3693
ord2224
ord3431
ord1780
ord4212
ord3667
ord3662
ord681
ord479
ord392
ord4548
ord2269
ord1656
ord450
ord4983
ord3563
ord2823
ord4689
ord1624
ord2055
ord4931
ord3685
ord3355
ord2824
ord734
ord4186
ord1259
ord1991
ord3502
ord1370
ord2671
ord3104
ord4461
ord4733
ord3428
ord3652
ord3170
ord4416
ord3169
ord5099
ord1358
ord2383
ord4170
ord1912
ord3640
ord2863
ord299
ord559
ord4581
ord4929
ord3779
ord3776
ord3774
ord492
ord3552
ord5077
ord3702
ord1100
ord1860
ord4415
ord3231
ord1033
ord4130
ord1789
ord2661
ord4227
ord4229
ord3366
ord3826
ord4239
ord4408
ord2021
ord1285
ord2986
ord706
ord528
ord3403
ord2640
ord736
ord4228
ord567
ord4143
ord308
ord4295
ord2063
ord1886
ord996
ord4846
ord4607
ord403
ord3446
ord4820
ord2052
ord1135
ord2104
ord4215
ord5058
ord1858
ord1876
ord4304
ord2484
ord3636
ord2753
ord2509
ord4749
ord3373
ord4901
ord3785
ord590
ord592
ord4258
ord4123
ord344
ord342
ord4566
ord3778
ord3777
ord1468
ord3542
ord4068
ord3611
ord3616
ord3969
ord3729
ord3739
ord3738
ord3726
ord3728
ord3725
ord4003
ord4001
ord4175
ord3001
ord1342
ord3664
ord671
ord4814
ord462
ord4190
ord2080
ord4166
ord4165
ord4163
ord2120
ord2207
ord4791
ord3375
ord1311
ord1066
ord3836
ord1871
ord3978
ord3716
ord2084
ord1408
ord1172
ord282
ord1313
ord1183
ord4015
ord4036
ord1275
ord2010
ord3990
ord3889
ord3870
ord828
ord1582
ord1899
ord1317
ord5005
ord3989
ord3867
ord556
ord4944
ord4588
ord1635
ord3421
ord293
ord817
ord3758
ord3872
ord1566
ord2076
ord3670
ord3944
ord3069
ord1310
ord2078
ord4208
ord3618
ord5076
ord4118
ord1781
ord4176
ord3651
ord1364
ord3362
ord4753
ord1862
ord4017
ord3948
ord4195
ord3019
ord1190
ord3131
ord1880

user32

TranslateMessage
DispatchMessageA
PeekMessageA
PostQuitMessage
GetMessageA
wsprintfA
SetClassLongA
InvalidateRect
UpdateWindow
PostMessageA
LoadStringA
DrawMenuBar
EnableMenuItem
SendMessageA
SetWindowTextA
DefWindowProcA
ShowWindow
CreateWindowExA
GetClientRect
ReleaseDC
GetDC
GetDesktopWindow
GetWindowRect
SetWindowPos
EndPaint
SetRectEmpty
GetSubMenu
AppendMenuA
GetSysColor
MessageBoxA
SetTimer
KillTimer
LoadIconA
LoadCursorA
RegisterClassA
GetMenuState
DestroyWindow
GetMenu
CheckMenuItem
BeginPaint

gdi32

SetTextColor
SetBkMode
GetTextExtentPoint32A
CreatePen
CreateSolidBrush
ExtTextOutA
SetBkColor
GetStockObject
PatBlt
SelectObject
GetTextExtentPointA
CreateFontIndirectA
DeleteObject
CreateFontA

comdlg32

GetOpenFileNameA
ChooseFontA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

DragAcceptFiles

comctl32

CreateToolbarEx
ord6
ord17

mfco42d

ord2974
ord1696
ord1664
ord1002
ord350
ord1224
ord598
ord1077
ord1173
ord1434
ord1163
ord2480
ord2478
ord1282
ord887
ord2437
ord366
ord1302
ord609
ord2243
ord1688
ord1668
ord3010
ord1175
ord2241
ord2803
ord938
ord2845
ord2673
ord1553
ord285
ord1552
ord2381
ord1658
ord1912
ord1773
ord770
ord2796
ord3139
ord1808
ord2577
ord971
ord1636
ord1010
ord3161
ord2754
ord1697
ord2263
ord949
ord1395
ord1481
ord1424
ord2802
ord2571
ord2622
ord2500
ord2563
ord2403
ord2375
ord2265
ord2196
ord2357
ord2574
ord2267
ord2276
ord2537
ord2366
ord753
ord1028
ord2355
ord1238
ord2779
ord2936
ord2065
ord1680
ord344
ord592
ord2219
ord1573
ord2223
ord1579
ord2268
ord2867
ord934
ord2084
ord983
ord873
ord1265
ord2250
ord970
ord2156
ord2522
ord1662
ord1187
ord922
ord2565
ord2804
ord2257
ord2759
ord2126
ord2681
ord595
ord591
ord359
ord347
ord343
ord607
ord2766
ord1040
ord2253
ord877
ord1270
ord957
ord2535
ord1739
ord2556
ord2506
ord2511
ord2516
ord2393
ord2377
ord2458
ord2569
ord2624
ord2490
ord2356
ord1750
ord2282
ord2558
ord2293
ord2606
ord2066
ord1689
ord2341
ord286
ord555
ord2088
ord2363
ord1247
ord1770
ord869
ord1259
ord1574
ord369
ord603
ord3146
ord2771
ord1014
ord798
ord809
ord2307
ord2616
ord2302
ord2629
ord2634
ord2635
ord2160
ord2534
ord2463
ord2438
ord1610
ord2526
ord1185
ord1074
ord2572
ord2279
ord2350
ord2495
ord2562
ord2269
ord2266
ord2573
ord2334
ord2560
ord2236
ord2614
ord2772
ord2342
ord2368
ord2851
ord2129
ord1509
ord2549

mfcn42d

ord277

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 25.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 356KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

a21a945a9cdde74bbd23bc411579dd48

Headers

File Characteristics

Imports

winmm

kernel32

mfc42d

user32

gdi32

comdlg32

advapi32

shell32

comctl32

mfco42d

mfcn42d

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 136KB - Virtual size: 25.2MB

.idata Size: 16KB - Virtual size: 13KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 356KB - Virtual size: 353KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 136KB - Virtual size: 25.2MB

.idata
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 356KB - Virtual size: 353KB