wakeT[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wakeT.exe
Size

119KB
MD5

c42fe68fbe13ac15674ee7c0b5b8dbe0
SHA1

dc7011abdf1a5353ab4df26702db473dc12952af
SHA256

901d3463af462b610958f25c71ba4b936d9c6efa0e4e8235f584c0befaab1f00
SHA512

2e73b32166a7f6d38627a2dec4eff66c56f0ba7e0c18655b906265c8d3a166cba704cae6daa662043ef48f30cefcc2d84084196fffdc65f8fe3fe3ac974b38b1
SSDEEP

3072:upvNhEcoI19zPE2xV4Ow48maiq7il+0go:upVh7547maJ0L

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

wakeT.exe
.exe windows x86

9c938abfb428792d944850b2507d3a4f

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:c5:a0:18:68:57:0e:87:49:f6:4d:0a:db:b8:fc:c9:0d:8c:ae:6a:79:be:46:49:8b:af:c3:13:10:c7:b2:16
Signer

Actual PE Digest

07:c5:a0:18:68:57:0e:87:49:f6:4d:0a:db:b8:fc:c9:0d:8c:ae:6a:79:be:46:49:8b:af:c3:13:10:c7:b2:16

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

22/09/2019, 06:09
Valid: true

Chain 1

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
__p__commode
_onexit
__dllonexit
_wcslwr
strlen
_itow
_wcsnicmp
memmove
malloc
swscanf
__p__fmode
__set_app_type
_controlfp
_except_handler3
_c_exit
towupper
wcscmp
_wcsicmp
free
_memicmp
modf
wcschr
memcmp
wcsrchr
wcstoul
qsort
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
_purecall
_wtoi
wcscpy
memset
_snwprintf
wcsncat
wcscat

comctl32

ImageList_ReplaceIcon
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

ReadProcessMemory
GetCurrentProcessId
ExitProcess
GetComputerNameW
SetErrorMode
DeleteFileW
OpenProcess
EnumResourceTypesW
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoW
FreeLibrary
GetStdHandle
GetPrivateProfileIntW
WritePrivateProfileStringW
EnumResourceNamesW
SystemTimeToFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetLastError
GetFileAttributesW
CloseHandle
FindResourceW
GetWindowsDirectoryW
WriteFile
FileTimeToLocalFileTime
LoadResource
ReadFile
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
CreateFileW
LockResource
LoadLibraryExW
GlobalAlloc
MultiByteToWideChar
LocalFree
GetSystemDirectoryW
lstrlenW
lstrcpyW
WideCharToMultiByte
GlobalUnlock
LocalFileTimeToFileTime
GetTempPathW
GetCurrentProcess
GetDateFormatW
GetTempFileNameW
GetFileSize
SizeofResource
GlobalLock
FindNextFileW
FindFirstFileW
FormatMessageW
GetVersionExW
FindClose
GetTimeFormatW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetPrivateProfileStringW

user32

DrawTextExW
TranslateMessage
IsDialogMessageW
GetMessageW
PostQuitMessage
LoadCursorW
SetCursor
GetSysColorBrush
TrackPopupMenu
ChildWindowFromPoint
SetDlgItemTextW
GetDlgItemTextW
InvalidateRect
GetSystemMetrics
GetWindowRect
GetWindowPlacement
DeferWindowPos
GetDlgItemInt
SetDlgItemInt
CreateWindowExW
GetWindow
BeginPaint
SetWindowPlacement
GetClientRect
EndPaint
DrawFrameControl
SendDlgItemMessageW
EndDialog
SetWindowLongW
SetWindowTextW
GetDlgItem
UpdateWindow
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
LoadAcceleratorsW
DefWindowProcW
LoadImageW
LoadIconW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetParent
GetMenu
GetSubMenu
EmptyClipboard
GetDC
EnableMenuItem
MoveWindow
ReleaseDC
GetClassNameW
OpenClipboard
CheckMenuItem
GetMenuItemCount
GetMenuStringW
SetClipboardData
EnableWindow
MapWindowPoints
GetCursorPos
CloseClipboard
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
SetWindowPos
GetDesktopWindow
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetDlgCtrlID
GetMenuItemInfoW
DestroyMenu
RegisterWindowMessageW
DispatchMessageW
ShowWindow

gdi32

GetTextExtentPoint32W
GetStockObject
SetBkColor
GetDeviceCaps
DeleteDC
SetPixel
GetPixel
SelectObject
CreateCompatibleDC
GetObjectW
SetBkMode
DeleteObject
SetTextColor
CreateFontIndirectW

comdlg32

ChooseFontW
FindTextW
GetSaveFileNameW

advapi32

ConvertStringSidToSidW
LookupAccountSidW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
SHGetMalloc

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c938abfb428792d944850b2507d3a4f

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

07:c5:a0:18:68:57:0e:87:49:f6:4d:0a:db:b8:fc:c9:0d:8c:ae:6a:79:be:46:49:8b:af:c3:13:10:c7:b2:16Signer

Signature Validations

Verification

22/09/2019, 06:09 Valid: true

Chain 1

Headers

File Characteristics

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 29KB - Virtual size: 29KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

07:c5:a0:18:68:57:0e:87:49:f6:4d:0a:db:b8:fc:c9:0d:8c:ae:6a:79:be:46:49:8b:af:c3:13:10:c7:b2:16
Signer

22/09/2019, 06:09
Valid: true

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 29KB - Virtual size: 29KB