winemenubuilder[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

winemenubuilder.exe
Size

698KB
MD5

4f9fa41ce98b4473dbc76e06bdbf6349
SHA1

d74329ef79e06d7f03fe26314aea46adb4abff36
SHA256

c7917a7e91404d2c818e1800cfc5963704109a92df762e0a9323153af8ec4060
SHA512

9740cf13f387dbdc39973b531166b25002bafb869abbfb62f964bec554e345b0cf1ddc7d725fcb77140db004321b363cedbbf3df116f628753a860f54c72de8c
SSDEEP

6144:JxHsKCK955Fy09aNfFqsGFUk6TzqymLZaZ7jmACJGFojpZoDko:JxMKsLNBPqylmAcx3oDko

Score

1^/10

Malware Config

Signatures

Files

winemenubuilder.exe
.exe windows x64

8f1a58547243ad76dd4c16a5d2adeebc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CommandLineFromMsiDescriptor
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegQueryValueExA
RegSetValueExW

kernel32

CloseHandle
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateSemaphoreA
CreateToolhelp32Snapshot
DeleteFileW
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsW
FindResourceW
FreeLibrary
FreeResource
GetCommandLineW
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLongPathNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetTempFileNameW
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrW
LoadLibraryExW
LoadResource
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
ReleaseSemaphore
UnmapViewOfFile
WideCharToMultiByte
wine_get_dos_file_name
wine_get_unix_file_name

ntdll

__wine_unix_spawnvp
_vsnprintf

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
PropVariantClear

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

shlwapi

AssocQueryStringW
PathFindFileNameW
PathRemoveExtensionW
PathSkipRootW
SHCreateStreamOnFileW

ucrtbase

__acrt_iob_func
__p___argc
__p___wargv
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vswprintf
_configure_wide_argv
_get_initial_wide_environment
_initialize_wide_environment
_set_app_type
_strdup
_wcsnicmp
_wfopen
_wgetenv
exit
fclose
feof
fgets
fputc
free
fwrite
getenv
memcmp
memcpy
memmove
strchr
strcmp
strcpy
strcspn
strlen
wcschr
wcscmp
wcsrchr
wcstok
wcstol

user32

CharLowerW
MsgWaitForMultipleObjects

windowscodecs

WICConvertBitmapSource

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 864B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f1a58547243ad76dd4c16a5d2adeebc

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

user32

windowscodecs

Sections

.text Size: 52KB - Virtual size: 48KB

.data Size: 4KB - Virtual size: 64B

.rdata Size: 36KB - Virtual size: 33KB

.pdata Size: 4KB - Virtual size: 648B

.xdata Size: 4KB - Virtual size: 872B

.bss Size: - Virtual size: 864B

.idata Size: 8KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 32B

/4 Size: 4KB - Virtual size: 224B

/19 Size: 228KB - Virtual size: 225KB

/31 Size: 8KB - Virtual size: 5KB

/45 Size: 48KB - Virtual size: 44KB

/57 Size: 8KB - Virtual size: 6KB

/70 Size: 8KB - Virtual size: 5KB

/81 Size: 148KB - Virtual size: 146KB

/92 Size: 28KB - Virtual size: 27KB

.text
Size: 52KB - Virtual size: 48KB

.data
Size: 4KB - Virtual size: 64B

.rdata
Size: 36KB - Virtual size: 33KB

.pdata
Size: 4KB - Virtual size: 648B

.xdata
Size: 4KB - Virtual size: 872B

.bss
Size: - Virtual size: 864B

.idata
Size: 8KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 32B

/4
Size: 4KB - Virtual size: 224B

/19
Size: 228KB - Virtual size: 225KB

/31
Size: 8KB - Virtual size: 5KB

/45
Size: 48KB - Virtual size: 44KB

/57
Size: 8KB - Virtual size: 6KB

/70
Size: 8KB - Virtual size: 5KB

/81
Size: 148KB - Virtual size: 146KB

/92
Size: 28KB - Virtual size: 27KB