Static task
static1
Behavioral task
behavioral1
Sample
wrc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
wrc.exe
Resource
win10v2004-20230220-en
General
-
Target
wrc.exe
-
Size
269KB
-
MD5
3e9da3aa34a95bc44a35e5c45b4272f7
-
SHA1
24e95eea7f34d22ca22d879506400dd178d11ad8
-
SHA256
be75b729beb17a492b7ff8716b6647485116f91bac23a90550833debf6c0fa4d
-
SHA512
978bf09874f4eb0688d3c0d6654d0c392fcfb2f8619efcccebd1364d3d251af447981e51b26fddb062d054604fee5d772f296bae3cb893b8c985cdc7d9e8498e
-
SSDEEP
3072:WYwMn5oD+IiGEYWQEtb0VIQ8jyV1MDwR+u/WjNuuDvD3Ex6Vmde1ZCaMyTQABuUd:WYwVypQEtbO585j4x6DCaP7G5M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wrc.exe
Files
-
wrc.exe.exe windows x86
65ecbbc5bb3f9df2f5066f2f5d7323a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CharUpperA
kernel32
CloseHandle
CreateEventA
CreateFileA
DeleteFileA
DosDateTimeToFileTime
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsA
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetOEMCP
GetProcAddress
GetStdHandle
GetTimeZoneInformation
GetVersion
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MultiByteToWideChar
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetEnvironmentVariableW
SetFilePointer
SetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
Sections
AUTO Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DGROUP Size: 5KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ