GoW[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GoW.exe
Size

18.8MB
MD5

28b7efe022b2ea8c0aa4b2be29e2bcd8
SHA1

3a6b6de2a5875c14752839ca0c9240132dcc70ef
SHA256

2424c3a08ea1d3435e8a8679ced80c869af1e978518809ef4a6d03534563f3a7
SHA512

40001c4e9894d19efe23d3a00f5707c8f38eabce67e381e318f7d09f443a39d790a0c3424db5c50092c4d55dc8d1564f735df4e3eb65d356c4a9d3a19019d11e
SSDEEP

196608:x8Hr1VwCRkYj4cfDefaCJDO5wFZq+KYsZwQFbH:KwCRk+f7efa+DO5wLYZwQN

Score

1^/10

Malware Config

Signatures

Files

GoW.exe
.exe windows x64

7a1ac21113e4ef93781f8bc882072b8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableW
CreateEventA
ResetEvent
SetEvent
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileExA
GetFileAttributesExA
SetThreadExecutionState
GetPrivateProfileStringA
WritePrivateProfileStringA
InitializeCriticalSection
WaitForSingleObject
LocalFree
CloseHandle
GetDiskFreeSpaceExW
GetFileAttributesW
CreateFileW
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
CreateDirectoryW
CreateDirectoryA
DebugBreak
IsDebuggerPresent
ExitProcess
GetModuleFileNameW
GetLargePageMinimum
VirtualAlloc
VirtualFree
SetUnhandledExceptionFilter
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
RaiseException
MultiByteToWideChar
SetErrorMode
GetUserDefaultLocaleName
OutputDebugStringA
GetSystemInfo
FormatMessageA
GetLastError
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleA
GetModuleFileNameA
GetFullPathNameW
CreateProcessW
InitializeCriticalSectionEx
CreateProcessA
GetModuleHandleExA
GetStdHandle
GetCurrentProcessId
OutputDebugStringW
LocalAlloc
GetSystemDirectoryW
ReleaseMutex
CreateMutexA
CreateFiber
ConvertThreadToFiber
ConvertFiberToThread
SwitchToFiber
DeleteFiber
AllocConsole
WriteConsoleA
SetConsoleTitleA
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateSemaphoreA
UnmapViewOfFile
CreateFileA
ReleaseSemaphore
CreateFileMappingA
CreateWaitableTimerA
GetFileSize
MapViewOfFile
GetFileTime
SetFileTime
GetFileAttributesA
SetWaitableTimer
GetThreadId
GetCurrentThread
DuplicateHandle
ResumeThread
MoveFileExA
TryEnterCriticalSection
CreateJobObjectA
QueryFullProcessImageNameA
AssignProcessToJobObject
SetInformationJobObject
GetSystemTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
CreateThread
DeleteCriticalSection
DeviceIoControl
DeleteFileA
VirtualProtect
VirtualQuery
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
GetVersionExA
SleepEx
GetTickCount
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
SetLastError
lstrcmpA
FileTimeToSystemTime
GetModuleHandleW
Sleep
GetConsoleWindow
GetFileType
TerminateThread
GetThreadContext
FreeConsole
SetThreadContext
QueryPerformanceFrequency
SetThreadAffinityMask
SetThreadPriority
WaitForMultipleObjectsEx
LoadLibraryExW

user32

GetAncestor
MoveWindow
AdjustWindowRect
DefWindowProcA
CreateWindowExA
GetForegroundWindow
TranslateMessage
ClipCursor
SendMessageA
SetCapture
LoadIconA
GetClientRect
PeekMessageA
RegisterRawInputDevices
GetKeyboardLayout
GetRawInputData
PostQuitMessage
GetParent
MapVirtualKeyExA
GetCapture
SetProcessDpiAwarenessContext
TrackMouseEvent
ReleaseCapture
ShowCursor
InvalidateRect
SetCursorPos
GetCursorPos
BeginPaint
EndPaint
VkKeyScanA
MapVirtualKeyA
MonitorFromWindow
EnumDisplayMonitors
GetMonitorInfoA
EnumDisplaySettingsA
MessageBoxA
UnregisterDeviceNotification
RegisterDeviceNotificationW
SetWindowLongPtrW
CallWindowProcW
IsWindow
SetThreadDpiAwarenessContext
PtInRect
SetWindowPlacement
GetWindowLongA
GetWindowPlacement
RegisterHotKey
ClientToScreen
SetWindowLongA
ScreenToClient
DestroyWindow
RegisterClassExA
GetCursorInfo
SetWindowPos
LoadCursorA
GetWindowRect
DispatchMessageA
UnregisterHotKey
EnumDisplayDevicesA
MessageBoxW
ShowWindow
GetWindowThreadProcessId
LoadKeyboardLayoutA
GetWindowLongPtrW

version

VerQueryValueA
GetFileVersionInfoA

xinput1_4

ord2
ord3

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DReflect

msvcp140

?_MP_Add@std@@YAXQEA_K_K@Z
?_MP_Rem@std@@YAXQEA_K_K@Z
?_MP_Mul@std@@YAXQEA_K_K1@Z
?_MP_Get@std@@YA_KQEA_K@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z

iphlpapi

GetAdaptersInfo

vcruntime140

set_unexpected
_set_purecall_handler
__std_terminate
__CxxFrameHandler3
_purecall
strstr
strchr
strrchr
wcschr
memset
wcsrchr
wcsstr
_CxxThrowException
__intrinsic_setjmp
memcpy
memcmp
memmove
longjmp
__C_specific_handler
__std_type_info_destroy_list
memchr

api-ms-win-crt-stdio-l1-1-0

_telli64
_read
_mktemp_s
ferror
_lseeki64
_filelengthi64
rewind
_open
_close
fseek
fputc
_fileno
_get_osfhandle
_fseeki64
fread
_fsopen
__stdio_common_vfprintf_s
ftell
_wfsopen
__stdio_common_vswprintf_s
fputs
__stdio_common_vsscanf
fflush
_set_fmode
__stdio_common_vsprintf
freopen
fopen
fclose
fgets
setvbuf
__p__commode
__stdio_common_vfprintf
_ftelli64
__stdio_common_vsprintf_s
fwrite
fopen_s
getc
__acrt_iob_func
_setmaxstdio
feof

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
abort
terminate
_register_thread_local_exe_atexit_callback
_set_abort_behavior
_c_exit
exit
set_terminate
_exit
_set_invalid_parameter_handler
_execute_onexit_table
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initterm
_crt_atexit
_get_narrow_winmain_command_line
_set_app_type
_controlfp
__sys_nerr
_initialize_narrow_environment
strerror
_errno
_beginthreadex
_endthreadex
_seh_filter_dll
_getpid
_initterm_e
_seh_filter_exe
_cexit
_crt_at_quick_exit
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

strcoll
strtok
wcsncpy_s
isdigit
_strlwr
_strupr
_strdup
_strnicmp
_stricmp
strncmp
tolower
isspace
islower
isupper
strncat
wcsnlen
wcscpy_s
_wcsnicmp
isprint
wcsncat_s
wcsncpy
_wcsupr
strncpy
strcpy_s
_wcsdup
strncpy_s
wcstok
strcmp
_wcsicmp
wcscat_s
ispunct
strpbrk
iscntrl
isxdigit
isgraph
strspn
isalnum
toupper
isalpha

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort
bsearch

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_aligned_realloc
calloc
realloc
_aligned_malloc
_aligned_free
malloc
free

api-ms-win-crt-convert-l1-1-0

strtof
_itoa
atoi
strtod
wcstombs
wcsrtombs
_strtoi64
mbstowcs
atof
strtol
strtoul

api-ms-win-crt-environment-l1-1-0

_putenv
getenv

api-ms-win-crt-math-l1-1-0

modf
atanf
frexp
cbrtf
roundf
tanhf
cosf
coshf
pow
sin
cos
atan2f
log10
_finite
exp
log10f
log
ldexp
logf
sinf
sinhf
tanf
asinf
_fdclass
exp2f
fmodf
powf
fmod
acosf
__setusermatherr
_fdtest
expf
modff

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
strftime
_time64
_localtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_splitpath_s
_fstat64
_splitpath

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

libscepad

scePadSetLightBar
scePadSetVibration
scePadGetControllerType
scePadSetParticularMode
scePadSetVibrationMode
scePadResetLightBar
scePadOpen
scePadRead
scePadInit

wldap32

ord79
ord143
ord60
ord27
ord50
ord200
ord33
ord32
ord26
ord46
ord30
ord211
ord35
ord22
ord41
ord301

wsock32

inet_ntoa
WSAGetLastError
send
getsockname
gethostbyaddr
inet_addr
gethostname
htonl
__WSAFDIsSet
setsockopt
WSAStartup
sendto
gethostbyname
listen
shutdown
select
closesocket
bind
accept
WSACleanup
ntohs
ntohl
WSASetLastError
getsockopt
recv
recvfrom
connect
socket
htons
getpeername

libscejobmanager

??0JobManager@Job@sce@@QEAA@XZ
?initialize@JobManager@Job@sce@@QEAAHPEAX_KIIPEBUConfigParams@123@@Z
?shutdown@JobManager@Job@sce@@QEAAHXZ
?calculateRequiredMemorySize@JobManager@Job@sce@@SA_KPEBUMemorySizeQueryParams@123@@Z
?setPersistentThreadCount@JobManager@Job@sce@@QEAAHI@Z
?getSequenceFactoryInterface@JobManager@Job@sce@@QEAAPEAVSequenceFactoryInterface@23@W4Priority@123@@Z
??1JobManager@Job@sce@@QEAA@XZ

bink2w64

BinkOpenDirectSound
BinkShouldSkip
BinkOpen
BinkDoFramePlane
BinkWait
BinkClose
BinkUtilMalloc
BinkGetGPUDataBuffersInfo
BinkRegisterGPUDataBuffers
BinkUtilFree
BinkPause
BinkNextFrame
BinkSetMemory
BinkSetSoundSystem

libscegnm

?getChannel@DataFormat@Gnm@sce@@QEBA?AW4TextureChannel@23@I@Z
?getDepth@Texture@Gnm@sce@@QEBAIXZ
?getHeight@Texture@Gnm@sce@@QEBAIXZ
?getWidth@Texture@Gnm@sce@@QEBAIXZ
?getLastMipLevel@Texture@Gnm@sce@@QEBAIXZ
?getDepthMinus1@Texture@Gnm@sce@@QEBAIXZ
?getHeightMinus1@Texture@Gnm@sce@@QEBAIXZ
?getWidthMinus1@Texture@Gnm@sce@@QEBAIXZ
?getTextureType@Texture@Gnm@sce@@QEBA?AW4TextureType@23@XZ
?getTextureChannelType@DataFormat@Gnm@sce@@QEBA?AW4TextureChannelType@23@XZ
?getSurfaceFormat@DataFormat@Gnm@sce@@QEBA?AW4SurfaceFormat@23@XZ
?getTotalArraySliceCount@Texture@Gnm@sce@@QEBAIXZ
?getLastArraySliceIndex@Texture@Gnm@sce@@QEBAIXZ
?getTileMode@Texture@Gnm@sce@@QEBA?AW4TileMode@23@XZ
?init@TextureSpec@Gnm@sce@@QEAAXXZ
?getDataFormat@Texture@Gnm@sce@@QEBA?AVDataFormat@23@XZ
?initAs2d@Texture@Gnm@sce@@QEAA?AVSizeAlign@23@IIIVDataFormat@23@W4TileMode@23@W4NumFragments@23@@Z
?getSizeAlign@Texture@Gnm@sce@@QEBA?AVSizeAlign@23@XZ
?initAsCubemap@Texture@Gnm@sce@@QEAA?AVSizeAlign@23@IIIVDataFormat@23@W4TileMode@23@@Z
?initAs2dArray@Texture@Gnm@sce@@QEAA?AVSizeAlign@23@IIIIVDataFormat@23@W4TileMode@23@W4NumFragments@23@_N@Z
?getBitsPerElement@DataFormat@Gnm@sce@@QEBAIXZ
?initAs3d@Texture@Gnm@sce@@QEAA?AVSizeAlign@23@IIIIVDataFormat@23@W4TileMode@23@@Z
?build@DataFormat@Gnm@sce@@SA?AV123@W4SurfaceFormat@23@W4TextureChannelType@23@W4TextureChannel@23@222@Z
?init@Texture@Gnm@sce@@QEAAHPEBVTextureSpec@23@@Z

libscegpuaddress

?getMicroTileModeForSurfaceType@GpuAddress@sce@@YAHW4GpuMode@Gnm@2@PEAW4MicroTileMode@42@W4SurfaceType@12@@Z
?detileSurface@GpuAddress@sce@@YAHPEAXPEBXPEBVTilingParameters@12@@Z
?getArrayModeForSurfaceType@GpuAddress@sce@@YAHW4GpuMode@Gnm@2@PEAW4ArrayMode@42@W4SurfaceType@12@I@Z
?tileSurface@GpuAddress@sce@@YAHPEAXPEBXPEBVTilingParameters@12@@Z
?initFromTexture@TilingParameters@GpuAddress@sce@@QEAAHPEBVTexture@Gnm@3@II@Z
?computeSurfaceTileMode@GpuAddress@sce@@YAHW4GpuMode@Gnm@2@PEAW4TileMode@42@W4ArrayMode@42@TSurfaceFlags@12@VDataFormat@42@IW4MicroTileMode@42@@Z
?getFlagsForSurfaceType@GpuAddress@sce@@YAHW4GpuMode@Gnm@2@PEATSurfaceFlags@12@W4SurfaceType@12@W4SurfaceMipmapMode@12@@Z
?computeTextureSurfaceOffsetAndSize@GpuAddress@sce@@YAHPEA_K0PEBVTexture@Gnm@2@II@Z

ws2_32

getaddrinfo
freeaddrinfo
getnameinfo
inet_pton

steam_api64

SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_UnregisterCallback
SteamAPI_Shutdown
SteamAPI_GetHSteamUser
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_RunCallbacks

gdi32

SetBkColor
ExtTextOutA

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ImpersonateSelf
LookupPrivilegeValueA

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
PropVariantClear
CoTaskMemAlloc
CoInitializeEx

oleaut32

VariantClear
VariantInit

api-ms-win-crt-multibyte-l1-1-0

_mbschr
_mbsnbcpy

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces

rpcrt4

UuidCreate

Exports

Exports

NVSDK_NGX_D3D11_AllocateParameters
NVSDK_NGX_D3D11_CreateFeature
NVSDK_NGX_D3D11_DestroyParameters
NVSDK_NGX_D3D11_EvaluateFeature
NVSDK_NGX_D3D11_EvaluateFeature_C
NVSDK_NGX_D3D11_GetCapabilityParameters
NVSDK_NGX_D3D11_GetParameters
NVSDK_NGX_D3D11_GetScratchBufferSize
NVSDK_NGX_D3D11_ReleaseFeature
NVSDK_NGX_D3D11_Shutdown
NVSDK_NGX_D3D11_Shutdown1
NVSDK_NGX_Parameter_GetD
NVSDK_NGX_Parameter_GetD3d11Resource
NVSDK_NGX_Parameter_GetD3d12Resource
NVSDK_NGX_Parameter_GetF
NVSDK_NGX_Parameter_GetI
NVSDK_NGX_Parameter_GetUI
NVSDK_NGX_Parameter_GetULL
NVSDK_NGX_Parameter_GetVoidPointer
NVSDK_NGX_Parameter_SetD
NVSDK_NGX_Parameter_SetD3d11Resource
NVSDK_NGX_Parameter_SetD3d12Resource
NVSDK_NGX_Parameter_SetF
NVSDK_NGX_Parameter_SetI
NVSDK_NGX_Parameter_SetUI
NVSDK_NGX_Parameter_SetULL
NVSDK_NGX_Parameter_SetVoidPointer
agsCheckDriverVersion
agsDeInitialize
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_CreateFromDevice
agsDriverExtensionsDX11_Destroy
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX11_WriteBreadcrumb
agsGetVersionNumber
agsInitialize
agsSetDisplayMode
g_pAKPluginList

Sections

.text
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 62.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 606KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 191KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a1ac21113e4ef93781f8bc882072b8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

version

xinput1_4

dxgi

d3d11

d3dcompiler_47

msvcp140

iphlpapi

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

libscepad

wldap32

wsock32

libscejobmanager

bink2w64

libscegnm

libscegpuaddress

ws2_32

steam_api64

gdi32

advapi32

shell32

ole32

oleaut32

api-ms-win-crt-multibyte-l1-1-0

setupapi

rpcrt4

Exports

Exports

Sections

.text Size: 13.2MB - Virtual size: 13.2MB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 1.7MB - Virtual size: 62.8MB

.pdata Size: 606KB - Virtual size: 608KB

_RDATA Size: 12KB - Virtual size: 16KB

.rsrc Size: 79KB - Virtual size: 80KB

.reloc Size: 191KB - Virtual size: 192KB

.text
Size: 13.2MB - Virtual size: 13.2MB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 1.7MB - Virtual size: 62.8MB

.pdata
Size: 606KB - Virtual size: 608KB

_RDATA
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 79KB - Virtual size: 80KB

.reloc
Size: 191KB - Virtual size: 192KB