wrapper_exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

wrapper_exe.zip
Size

322KB
MD5

bcdde8ccd0851e70ce2854cde9f9e975
SHA1

25a44010fe7fe868333db8cbed93dbf7c4b70e18
SHA256

49b3ee6dc1e346401299e2269b0e5e10227cb90f66e3b74fdeb2325b90423a8d
SHA512

8b79164a2db968ae524109c8cf9abdc890e4783470016f81d22d1c606691d1ee70de31b589416797d7ae744ed7f16820b57e301e61747d41c3989d88854764b9
SSDEEP

6144:FQYWE+V7Z89rgm/lQ6kYcCFFisJyQ7DSgl1ya3UQLtCX:cEayrgsO3Ynisjmgrya3Ul

Score

1^/10

Malware Config

Signatures

Files

wrapper_exe.zip
.zip

Password: 12345#asdf
Device/HarddiskVolume2/Program Files/AgentHost/com.wu.agentsvc.agenthost/eclipse/windowsservice/wrapper.exe
.exe windows x64

Password: 12345#asdf

8fa4c17c0ce9a06447a479af4bcbbe76

Code Sign

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/11/2020, 00:00

Not After

18/11/2023, 23:59

Subject

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/11/2020, 00:00

Not After

18/11/2023, 23:59

Subject

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:b2:e6:5f:24:70:9e:21:83:c0:ec:86:51:68:f8:da:f9:b8:04:af:b9:f0:04:ce:25:6f:cd:4e:4e:fe:a8:b3
Signer

Actual PE Digest

b3:b2:e6:5f:24:70:9e:21:83:c0:ec:86:51:68:f8:da:f9:b8:04:af:b9:f0:04:ce:25:6f:cd:4e:4e:fe:a8:b3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

07/02/2023, 20:40
Valid: true

Chain 1

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

4b:4e:08:85:51:3f:dd:35:48:cd:03:a9:1c:fa:af:61:93:25:d8:cc
Signer

Actual PE Digest

4b:4e:08:85:51:3f:dd:35:48:cd:03:a9:1c:fa:af:61:93:25:d8:cc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

07/02/2023, 20:40
Valid: true

Chain 1

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetUniversalNameW

shell32

ShellExecuteExW

netapi32

NetWkstaGetInfo
NetApiBufferFree

wsock32

getservbyname
accept
sendto
WSAStartup
inet_ntoa
gethostname
inet_addr
ioctlsocket
htonl
WSAGetLastError
htons
ntohs
getservbyport
listen
bind
socket
recv
WSASetLastError
closesocket
gethostbyaddr
gethostbyname
send

shlwapi

PathFindOnPathW
PathIsDirectoryW

advapi32

RegisterServiceCtrlHandlerW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
LsaAddAccountRights
RegCreateKeyExW
GetTokenInformation
LsaEnumerateAccountRights
OpenServiceW
LsaOpenPolicy
LogonUserW
ReportEventW
DeregisterEventSource
RegCreateKeyW
RegisterEventSourceW
LsaFreeMemory
RegSetValueExW
RegCloseKey
QueryServiceConfigW
ConvertSidToStringSidW
AdjustTokenPrivileges
ControlService
StartServiceCtrlDispatcherW
LsaNtStatusToWinError
RegOpenKeyExW
RegEnumValueW
SetServiceStatus
ChangeServiceConfigW
LsaClose
QueryServiceStatus
StartServiceW
LookupAccountSidW
ChangeServiceConfig2W
LookupPrivilegeValueW
CreateServiceW
LsaRemoveAccountRights
CloseServiceHandle
OpenProcessToken
LsaQueryInformationPolicy
DeleteService
OpenSCManagerW
LookupAccountNameW

user32

GetSystemMetrics
LoadStringW
DispatchMessageW
GetWindow
GetWindowThreadProcessId
DestroyWindow
SetWindowPlacement
GetWindowRect
IsIconic
GetTopWindow
GetKeyState
SetForegroundWindow
FindWindowW
TranslateMessage
GetForegroundWindow
RegisterClassExW
GetWindowPlacement
SystemParametersInfoW
PeekMessageW
ShowWindow
CreateWindowExW
IsWindowVisible
UpdateWindow
DefWindowProcW

crypt32

CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam

wintrust

WinVerifyTrust

pdh

PdhCollectQueryData
PdhOpenQueryW
PdhGetFormattedCounterValue

ole32

CoCreateInstance
CoUninitialize
StringFromCLSID
CoInitialize
CoTaskMemFree

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersAddresses

kernel32

DeleteCriticalSection
GetCurrentDirectoryA
GetDriveTypeA
LCMapStringW
SetHandleCount
GetStartupInfoA
CreateFileA
WriteConsoleA
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
GetStringTypeW
SetFilePointer
SetEndOfFile
GetProcessHeap
GetCommandLineW
GetTickCount
LCMapStringA
GetStringTypeA
RtlUnwindEx
GetModuleFileNameA
HeapCreate
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandle
FindNextFileW
MoveFileW
ExitProcess
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
HeapReAlloc
HeapSize
CompareStringA
GetFileType
SetStdHandle
LeaveCriticalSection
EnterCriticalSection
ReadConsoleInputW
ReadConsoleInputA
GetConsoleCP
DeleteFileW
GetSystemTimeAsFileTime
SetCurrentDirectoryW
SetEnvironmentVariableW
FindFirstFileW
FindClose
HeapAlloc
HeapFree
GetTimeZoneInformation
WriteConsoleW
GetACP
GetFullPathNameW
CreateMutexW
PeekNamedPipe
FreeLibrary
GetEnvironmentStringsW
WaitForSingleObject
ConnectNamedPipe
GetModuleHandleW
CreateNamedPipeW
WriteFile
WideCharToMultiByte
LoadLibraryW
GetConsoleMode
GetLocaleInfoW
GetVersionExW
SetConsoleMode
TerminateProcess
ReadFile
GetSystemDirectoryA
RaiseException
MultiByteToWideChar
SetThreadLocale
GetStdHandle
GetLastError
SetLastError
GetThreadLocale
GetProcAddress
IsValidCodePage
LoadLibraryA
Process32FirstW
GetSystemInfo
GetOEMCP
Process32NextW
SetConsoleTitleW
FreeEnvironmentStringsW
CreateToolhelp32Snapshot
ReleaseMutex
CloseHandle
GetSystemDefaultLangID
GetEnvironmentVariableW
GetFileSize
lstrcmpA
SetPriorityClass
GetDriveTypeW
AllocConsole
GetCPInfo
GetSystemDefaultUILanguage
CreateProcessW
EndUpdateResourceW
GetCurrentProcess
QueryPerformanceCounter
SetEvent
GenerateConsoleCtrlEvent
WaitNamedPipeW
OpenProcess
GlobalAlloc
Sleep
CopyFileW
GetConsoleWindow
FormatMessageW
GetExitCodeProcess
FileTimeToSystemTime
GetModuleFileNameW
CreateFileW
lstrlenW
GetStartupInfoW
DisconnectNamedPipe
FlushFileBuffers
GetConsoleOutputCP
GetCPInfoExW
GetCurrentDirectoryW
BeginUpdateResourceW
GlobalFree
GetLocalTime
ProcessIdToSessionId
LocalAlloc
SetConsoleCtrlHandler
GlobalMemoryStatusEx
CreateEventW
SetNamedPipeHandleState
CreatePipe
UpdateResourceW
QueryPerformanceFrequency
GetUserDefaultUILanguage
GetCurrentThreadId
DuplicateHandle
FileTimeToLocalFileTime
GetCurrentProcessId
LocalFree
lstrcpyW
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW

Sections

.text
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: 12345#asdf

Password: 12345#asdf

8fa4c17c0ce9a06447a479af4bcbbe76

Code Sign

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5eCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5eCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b3:b2:e6:5f:24:70:9e:21:83:c0:ec:86:51:68:f8:da:f9:b8:04:af:b9:f0:04:ce:25:6f:cd:4e:4e:fe:a8:b3Signer

Signature Validations

Verification

07/02/2023, 20:40 Valid: true

Chain 1

Chain 2

4b:4e:08:85:51:3f:dd:35:48:cd:03:a9:1c:fa:af:61:93:25:d8:ccSigner

Signature Validations

Verification

07/02/2023, 20:40 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

mpr

shell32

netapi32

wsock32

shlwapi

advapi32

user32

crypt32

wintrust

pdh

ole32

version

iphlpapi

kernel32

Sections

.text Size: 451KB - Virtual size: 450KB

.rdata Size: 243KB - Virtual size: 242KB

.data Size: 7KB - Virtual size: 198KB

.pdata Size: 18KB - Virtual size: 18KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 3KB - Virtual size: 2KB

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b3:b2:e6:5f:24:70:9e:21:83:c0:ec:86:51:68:f8:da:f9:b8:04:af:b9:f0:04:ce:25:6f:cd:4e:4e:fe:a8:b3
Signer

07/02/2023, 20:40
Valid: true

4b:4e:08:85:51:3f:dd:35:48:cd:03:a9:1c:fa:af:61:93:25:d8:cc
Signer

07/02/2023, 20:40
Valid: true

.text
Size: 451KB - Virtual size: 450KB

.rdata
Size: 243KB - Virtual size: 242KB

.data
Size: 7KB - Virtual size: 198KB

.pdata
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 3KB - Virtual size: 2KB