General
-
Target
WTF.exe
-
Size
233KB
-
MD5
20b2728609d7faa58e849da0a59338c6
-
SHA1
adf4aae5160b26370e4f90620e9b0edcbb56c432
-
SHA256
62ff0a5549714ae5eb96cc23f73477139defc5fa6dcd3aa73f82e3e2a3d17e6f
-
SHA512
2704f6b46ef9a2fd53effc313bebf780af43bc91124687aecf5d7f1c1d5b23216a575b395ccb4b7665336ecdffe2faae3f2def874a249601d875f5c95ea10773
-
SSDEEP
6144:MHiY4M4cQ0sFyu8QXiEmGVPhvVIMPjshE1PcL43/:MHJ4M9Q0F4yk5uBhED
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
WTF.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 740KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 230KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE