WWAHost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WWAHost.exe
Size

611KB
MD5

a7b70cc424cda9813e0faa1e6e165d80
SHA1

42b635e03fb9cf3adbd4f8d6ee5cdc65b8f62a6f
SHA256

074fe023b714ea1bce48a32737c903a904e55a3b8d32196f122a4082d6ab37e6
SHA512

1068bf105054e2d15a28423ce03484e8f335f035e13a958d803097b9ff82e6f49954dc262b7cb47e0dc8d1036f96e7d215e5ee6b6edd6849ad6c08f38fa486ad
SSDEEP

12288:Zd4JzKOUAWp+QrTXi5w5qD3NgALAnxq5m7xa7M3cYCplgW2S2zjDGpyK7P8wVSJX:Zd4JzKOUAWp+QrTXi5w5qD3NgALOxq5M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WWAHost.exe

Files

WWAHost.exe
.exe windows x86

a4b4f1ba94197c9b94cef7ed09a6b67a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strchr
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlGetVersion
wcsstr
wcschr
EtwEventRegister
EtwEventWrite
EtwEventUnregister
WinSqmEndSession
WinSqmSetDWORD
RtlFreeSid
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlFindAceByType
RtlEqualSid
RtlAllocateAndInitializeSid
RtlInitUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
_wcsnicmp
NtGetCachedSigningLevel
memmove
wcsncmp
_vsnwprintf
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
memset
WinSqmAddToStreamEx
RtlCaptureContext
WinSqmStartSession
WinSqmIsOptedIn
memcpy_s
_itow_s
_chkstk
_ftol2
_ftol2_sse
memcmp
memcpy
RtlUnwind

api-ms-win-appmodel-runtime-internal-l1-1-0

GetPackagePropertyString
GetPackageApplicationPropertyString
GetPackageProperty
GetCurrentPackageApplicationContext
GetPackageOSMaxVersionTested
GetCurrentPackageContext

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockExclusive
InitOnceInitialize
AcquireSRWLockExclusive
SetEvent
CreateEventW
ResetEvent
InitOnceExecuteOnce
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
SleepEx
WaitForMultipleObjectsEx

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoOriginateError

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
CheckTokenCapability
GetTokenInformation

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetProcessTimes
OpenProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringW

api-ms-win-core-file-l1-2-1

GetFileAttributesW
CreateFileW
GetFileSizeEx
WriteFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
CompareStringOrdinal

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-memory-l1-1-2

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-localization-l1-2-1

LCMapStringW
SetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-path-l1-1-0

PathCchCombineEx

profapi

ord104

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-ro-typeresolution-l1-1-0

RoResolveNamespace
RoGetMetaDataFile

combase

ord87
ord86
ord110
ord90
ord111
ord88

iertutil

ord174
CreateUri
ord177
CreateIUriBuilder

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4b4f1ba94197c9b94cef7ed09a6b67a

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

api-ms-win-appmodel-runtime-internal-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

profapi

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-ro-typeresolution-l1-1-0

combase

iertutil

api-ms-win-core-heap-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 532KB - Virtual size: 532KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 1024B - Virtual size: 640B

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 532KB - Virtual size: 532KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 1024B - Virtual size: 640B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 31KB - Virtual size: 31KB