Static task
static1
Behavioral task
behavioral1
Sample
wab.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
wab.exe
Resource
win10v2004-20230221-en
General
-
Target
wab.exe
-
Size
505KB
-
MD5
0bc9f91c2df9d41f48460b47c38f7750
-
SHA1
da3ec08492030a69d9ffaf52667f5ec59fc5c25a
-
SHA256
fab60c4415115205b6b8911e78fa917e0b57d6fe698f609e16e8822570c6dca7
-
SHA512
f126d62f92d1393a012c152672e2a525a5fb4bdc7585036b4912203a2a1ee0357187333b523f5ee4737a0e21ee4a0c9163fd9d70bb1ceeca7fac71581d992bda
-
SSDEEP
12288:bTx5KRZ18xtSP+szdcIugOO50MMEMOkPE:4mxtSP+sJ+O5FWPP
Malware Config
Signatures
Files
-
wab.exe.exe windows x86
0ef04699a47ecf41df8e2b3dd1491d68
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExW
EventUnregister
RegOpenKeyExW
EventSetInformation
EventRegister
EventWriteTransfer
RegCloseKey
kernel32
ExpandEnvironmentStringsW
GetCommandLineW
GetLastError
LoadLibraryW
HeapSetInformation
GetProcAddress
LocalFree
GetProcessHeap
FreeLibrary
Sleep
HeapFree
GetFileAttributesW
DelayLoadFailureHook
ResolveDelayLoadedAPI
LocalAlloc
IsDBCSLeadByte
HeapAlloc
RegisterApplicationRestart
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
gdi32
GetStockObject
user32
RegisterClassW
LoadIconW
LoadCursorW
PostQuitMessage
LoadStringW
CreateWindowExW
MessageBoxW
DefWindowProcW
msvcrt
__p__fmode
_cexit
memset
exit
__set_app_type
__getmainargs
__setusermatherr
__p__commode
_XcptFilter
_initterm
_controlfp
_except_handler4_common
_ismbblead
_amsg_exit
?terminate@@YAXXZ
memcpy
_acmdln
_exit
shell32
CommandLineToArgvW
shlwapi
PathFindExtensionW
PathAppendW
PathRemoveFileSpecW
StrCmpNIW
StrCmpIW
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ