wbadmin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wbadmin.exe
Size

277KB
MD5

e60fb807c5a0d66d6a60fb8da5f5fad3
SHA1

c2dbe04d245ba63faf88d30540b566b03575393b
SHA256

433b05c66f0f1f31319668759f9e5be201e3a7c3b93045b3d2752dff3e112e50
SHA512

cde2f6e0423aed334f7b1f30af52f7ee4b6e41033e03fb7a842b788a2aad85b3df7e49333276b9c22a811f1253e037673f7aa26889404e70c759708d8e410623
SSDEEP

3072:n6700eEh5hrv6yrPRBIZlH0SHHqcfjcOOFNaj0E7/kpEDSjx2WTMGFfAKbTUUKio:M0WnhGS5BMlhqcrmbajSjxHFfAIeLn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wbadmin.exe

Files

wbadmin.exe
.exe windows x64

b8c577d7b953fa1c1cdb7dfe18c52f02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
CreateWellKnownSid
CheckTokenMembership
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetLengthSid
IsValidSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
IsValidSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
ControlTraceW
StartTraceW
EnableTrace
ImpersonateLoggedOnUser
LogonUserExExW
SetFileSecurityW
RevertToSelf
EventUnregister
EventEnabled
EventRegister
EventWrite

kernel32

GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetDiskFreeSpaceExW
LoadLibraryExW
GetSystemDirectoryW
MoveFileExW
DeleteFileW
GetFileAttributesW
DeviceIoControl
CreateDirectoryW
GetVolumeNameForVolumeMountPointW
GetComputerNameExW
GetVersionExW
GetVolumePathNameW
ExpandEnvironmentStringsW
LocalAlloc
SetLastError
PeekConsoleInputW
CompareStringW
GetConsoleCP
MultiByteToWideChar
ReadFile
ReadConsoleW
FlushConsoleInputBuffer
SetConsoleMode
FreeLibrary
WideCharToMultiByte
WriteConsoleW
WriteFile
GetDriveTypeW
CreateFileW
GetConsoleMode
GetFileType
GetStdHandle
SetThreadUILanguage
GetConsoleOutputCP
FormatMessageW
GetLastError
LocalFree
HeapSetInformation
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetSystemTime
RaiseException
GetModuleHandleW
SystemTimeToFileTime
FileTimeToLocalFileTime
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CloseHandle
Sleep
GetLocalTime
GetTimeZoneInformation
CompareFileTime

msvcrt

memset
memcpy
memcmp
__CxxFrameHandler3
wcsncmp
_wcsupr
_vsnprintf
_wcsicmp
wcschr
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
_purecall
_wsetlocale
malloc
memmove_s
calloc
free
wcsstr
_wcsnicmp
wcsrchr
memcpy_s
_wtol
_vsnwprintf
exit
wprintf
_wtoi
wcscspn
wcscmp

ole32

CoInitializeSecurity
CoInitializeEx
CoTaskMemRealloc
CoCreateInstance
CoUninitialize
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree

user32

LoadStringW

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocString

rpcrt4

RpcStringFreeW
UuidToStringW
UuidFromStringW

ntdll

RtlNtStatusToDosError
RtlCheckPortableOperatingSystem
NtQueryInformationFile
NtQueryVolumeInformationFile
NtQuerySystemInformation

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

credui

CredUICmdLinePromptForCredentialsW

Sections

.text
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8c577d7b953fa1c1cdb7dfe18c52f02

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

user32

oleaut32

rpcrt4

ntdll

setupapi

credui

Sections

.text Size: 233KB - Virtual size: 232KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 256B

.text
Size: 233KB - Virtual size: 232KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 256B