WWAHost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WWAHost.exe
Size

510KB
MD5

218d7ff8ec006caaaebe590405851af9
SHA1

9a21e4d38a399905b3adcb067793f736718edc34
SHA256

fb40a3c124fcaae8ff1e5c91acaad489da16b5ff0ef623922946881b802fcee5
SHA512

78ba9c8bc9dfbe5cfe126f7011d304a0e4565c9393de054a9a71ee64f3f7efecdd6510d7889b6456f1618b462309c6b859b41868842ce993cb571668938efa04
SSDEEP

12288:ChWcRJ3xbHF4a8hC98Kp/yfO+YiC55W4PStV5KLv8V4mw/PGTC9gSr6ne:Ccc/3xbHF4a8hC98Kp/yfO+YiC55W4PX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WWAHost.exe

Files

WWAHost.exe
.exe windows x86

a4b4f1ba94197c9b94cef7ed09a6b67a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strchr
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlGetVersion
wcsstr
wcschr
EtwEventRegister
EtwEventWrite
EtwEventUnregister
WinSqmEndSession
WinSqmSetDWORD
RtlFreeSid
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlFindAceByType
RtlEqualSid
RtlAllocateAndInitializeSid
RtlInitUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
_wcsnicmp
NtGetCachedSigningLevel
memmove
wcsncmp
_vsnwprintf
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
memset
WinSqmAddToStreamEx
RtlCaptureContext
WinSqmStartSession
WinSqmIsOptedIn
memcpy_s
_itow_s
_chkstk
_ftol2
_ftol2_sse
memcmp
memcpy
RtlUnwind

api-ms-win-appmodel-runtime-internal-l1-1-0

GetPackagePropertyString
GetPackageApplicationPropertyString
GetPackageProperty
GetCurrentPackageApplicationContext
GetPackageOSMaxVersionTested
GetCurrentPackageContext

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockExclusive
InitOnceInitialize
AcquireSRWLockExclusive
SetEvent
CreateEventW
ResetEvent
InitOnceExecuteOnce
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
SleepEx
WaitForMultipleObjectsEx

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoOriginateError

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
CheckTokenCapability
GetTokenInformation

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetProcessTimes
OpenProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringW

api-ms-win-core-file-l1-2-1

GetFileAttributesW
CreateFileW
GetFileSizeEx
WriteFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
CompareStringOrdinal

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-memory-l1-1-2

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-localization-l1-2-1

LCMapStringW
SetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-path-l1-1-0

PathCchCombineEx

profapi

ord104

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-ro-typeresolution-l1-1-0

RoResolveNamespace
RoGetMetaDataFile

combase

ord87
ord86
ord110
ord90
ord111
ord88

iertutil

ord174
CreateUri
ord177
CreateIUriBuilder

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4b4f1ba94197c9b94cef7ed09a6b67a

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

api-ms-win-appmodel-runtime-internal-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

profapi

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-ro-typeresolution-l1-1-0

combase

iertutil

api-ms-win-core-heap-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 438KB - Virtual size: 438KB

.data Size: 3KB - Virtual size: 3KB

.idata Size: 7KB - Virtual size: 6KB

minATL Size: - Virtual size: 12B

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 438KB - Virtual size: 438KB

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 7KB - Virtual size: 6KB

minATL
Size: - Virtual size: 12B

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 24KB - Virtual size: 24KB