Static task
static1
Behavioral task
behavioral1
Sample
waifu2x_snowshell.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
waifu2x_snowshell.exe
Resource
win10v2004-20230220-en
General
-
Target
waifu2x_snowshell.exe
-
Size
3.4MB
-
MD5
d6011acde184a16252ed221a596ca0b7
-
SHA1
2c6be1e8a6b73004009d44b43f19531af38561de
-
SHA256
a29ef81bfee6b1ee9b4403bf4a7538b190f044457674bcb528630c344f1f56e0
-
SHA512
519deed47af40bc6b0499f3b63e7266ca1545c7d180261e77ebf6e4b479953b87c7a729740d0780b573f53580b47e9c0deab666023c3981a2734b10ccd55195a
-
SSDEEP
12288:3ZfDJpuiKK8Jya0KrHR28UaML0rsrBrHrrrxDscOb:3H78f2wVodLvxoLb
Malware Config
Signatures
Files
-
waifu2x_snowshell.exe.exe windows x86
10ff17efaef470783bef0c453db1857e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
CreatePipe
FindClose
GetLocaleInfoW
CreateFileW
GetFileAttributesW
GetPrivateProfileStringW
LoadLibraryA
lstrcatW
LockResource
DeleteFileW
LoadLibraryW
LoadResource
FindResourceW
GetCurrentDirectoryW
CreateProcessW
FreeLibrary
FindNextFileW
GetCurrentProcess
IsWow64Process
ReadConsoleW
SetEndOfFile
HeapSize
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetStdHandle
GetPrivateProfileIntW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
GetFileType
HeapFree
HeapAlloc
GetACP
ExitProcess
WriteFile
WritePrivateProfileStringW
SetHandleInformation
FindFirstFileW
SizeofResource
ReadFile
lstrcpyW
CreateThread
CloseHandle
TerminateThread
Sleep
ExitThread
TerminateProcess
WaitForSingleObject
CreateDirectoryW
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentThreadId
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
GetLastError
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteConsoleW
user32
DefWindowProcW
LoadMenuW
GetWindowRect
CreateWindowExW
EndDialog
DispatchMessageW
RegisterClassW
SetMenu
LoadBitmapW
DestroyMenu
TranslateMessage
LoadIconW
LoadCursorW
GetClientRect
PostQuitMessage
GetMessageW
DialogBoxParamW
InvalidateRect
BeginPaint
EndPaint
GetWindowTextW
ModifyMenuW
GetSubMenu
CheckMenuItem
EnableMenuItem
CreateDialogParamW
DestroyWindow
MessageBoxW
SendMessageW
SetWindowTextW
ShowWindow
SetDlgItemTextW
SendDlgItemMessageW
wsprintfW
GetDlgItem
GetDesktopWindow
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateFontW
GetStockObject
DeleteDC
TextOutW
SetTextColor
SetBkMode
GetObjectW
GetTextColor
DeleteObject
comdlg32
GetOpenFileNameW
shell32
DragQueryFileW
ShellExecuteExW
DragAcceptFiles
CommandLineToArgvW
Sections
.text Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ