WoA3D[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

WoA3D.exe
Size

1.8MB
MD5

00ab8c06950851609b3cfa6238414bdd
SHA1

67ce86c56ca2ad0a9d11d94ea3d47ee18c18822c
SHA256

8c93a7bf327fc0b324e0be1c72df8b82fba091179bdc6b00ed61bba8359b9d15
SHA512

d1e6395dc0a3ee1e5ab4825364b188746335fac43391ba9b44a7a02a971bbe78f99b2dd9154489da754e6d056233effacefa3877d2dc0c1bcaa0292813fc643e
SSDEEP

49152:X88C+VyeXaEbcYX2IVqeeZkKXl4unyehzs:X88C+VyeXatIVqeeZkMl4unyOzs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WoA3D.exe

Files

WoA3D.exe
.exe windows x86

ee3f94b98f03c220f4d083375380670a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkSetSoundSystem@8
_BinkOpenDirectSound@4
_BinkWait@4
_BinkClose@4
_BinkDoFrame@4
_BinkCopyToBuffer@28
_BinkDDSurfaceType@4
_BinkOpen@8
_BinkNextFrame@4

granny

_GrannyGetNextIntersection@12
_GrannyGetIntersectionsLeft@12
_GrannyLockSequenceForRayIntersection@20
_GrannyGetBoneTreeState@20
_GrannyUnlockIntersection@8
_GrannyUnlockRendering@8
_GrannyUnlockRenderingState@4
_GrannyAttachSequence@32
_GrannyStopWearingSequence@8
_GrannyWearSequence@16
_GrannyGetAnimationParameter@20
_GrannyHasControlExpired@16
_GrannyAddControlledAnimation@20
_GrannySetAnimationParameter@24
_GrannySetSequenceAccumulating@12
_GrannyOpenSequence@12
_GrannySetSequencePosition@12
_GrannyCloseSequence@8
_GrannyReleaseControlledAnimation@12
_GrannyClose@4
_GrannyOpenVersion@20
_GrannyGetPreference@12
_GrannySetPreference@12
_GrannyGetBoneCount@12
_GrannyGetBoneState@20
_GrannyOpenAnimation@12
_GrannyGetToolCoordinateSystemForAnimation@16
_GrannyTransformAnimation@16
_GrannyOpenModel@12
_GrannyGetToolCoordinateSystemForModel@16
_GrannyRecommendTransform@28
_GrannyTransformModel@16
_GrannyCloseAnimation@8
_GrannyCloseModel@8
_GrannyGetExpiredTexturesLeft@8
_GrannyGetNextExpiredTextureCookie@8
_GrannyGetCurrentTime@8
_GrannyAdvanceTime@12
_GrannyGetNewTexturesLeft@8
_GrannyLockNextNewTexture@8
_GrannyUnlockNewTexture@8
_GrannyAllowTextureFormat@8
_GrannyLockNextRenderingState@12
_GrannyGetRenderingStatesLeft@12
_GrannyLockSequenceForRendering@16
_GrannyDetachSequence@8

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetFullPathNameA
GetCurrentDirectoryA
SetFilePointer
FlushFileBuffers
GetFileType
GetStartupInfoA
WideCharToMultiByte
CreateDirectoryA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
InterlockedDecrement
InterlockedIncrement
SetHandleCount
GetStdHandle
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
HeapSize
LCMapStringA
LCMapStringW
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
Sleep
InterlockedExchange
CloseHandle
WriteFile
CreateFileA
GetLastError
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
FindFirstFileA
QueryPerformanceFrequency
FreeEnvironmentStringsW
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
GetProcAddress
LoadLibraryA
GetLogicalDrives
GlobalMemoryStatus
GetTickCount
SetThreadPriority
CreateThread
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResumeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FlushViewOfFile
GetCurrentProcessId
FreeLibrary
GetVersion
OpenFileMappingA
ExitProcess
GetVersionExA
GlobalUnlock
GlobalLock
MultiByteToWideChar
GetACP
IsDBCSLeadByte
CreateMutexA
ReleaseMutex
GetTimeZoneInformation
GetSystemInfo
DeviceIoControl
GetLogicalDriveStringsA
SetFileAttributesA
GetFileAttributesA
GetCommandLineA
GetProfileStringA
TerminateProcess
CreateProcessA
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
MoveFileA
DeleteFileA
GetExitCodeProcess
SetCurrentDirectoryA
ReadFile
GetCurrentProcess
OpenMutexA
lstrcmpiA
IsBadReadPtr
GetModuleHandleA
GetWindowsDirectoryA
GetEnvironmentStrings
GetEnvironmentStringsW
SetEndOfFile
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CompareStringA
CompareStringW
QueryPerformanceCounter
SetEnvironmentVariableA

user32

GetDoubleClickTime
DestroyMenu
ShowCursor
GetMenu
SetWindowTextA
SetWindowTextW
IsWindowUnicode
CheckMenuItem
LoadAcceleratorsA
SetCursor
LoadCursorA
GetWindowDC
GetDesktopWindow
FindWindowA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
PeekMessageA
UnregisterClassA
UnregisterClassW
SendMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
CreateWindowExW
RegisterClassW
LoadIconA
LoadMenuA
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DefWindowProcA
DefWindowProcW
GetActiveWindow
SetFocus
SetCapture
ReleaseCapture
IsZoomed
GetSystemMetrics
EndPaint
BeginPaint
PostQuitMessage
GetWindowRect
GetFocus
ScreenToClient
GetCursorPos
DestroyWindow
GetMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
SetMenu
MoveWindow
MapVirtualKeyA
KillTimer
SetTimer
LoadImageA
DrawTextA
GetParent
SetWindowPlacement
AdjustWindowRectEx
GetWindowPlacement
GetClassInfoA
GetAsyncKeyState
GetKeyState
wsprintfA
MessageBoxA
CopyRect
IsIconic
GetClientRect
ClientToScreen
GetDC
ReleaseDC
GetKeyNameTextA

gdi32

StretchBlt
DeleteDC
GetPaletteEntries
GetDeviceCaps
SetTextColor
SetBkMode
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetStockObject
GetObjectA

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

ole32

CoUninitialize
CoInitialize

wsock32

htons
recvfrom
ntohl
gethostbyname
gethostname
WSAStartup
WSACleanup
closesocket
inet_ntoa
setsockopt
send
connect
socket
htonl
__WSAFDIsSet
select
WSAGetLastError
recv
ntohs
bind
sendto

ddraw

DirectDrawEnumerateExA
DirectDrawCreateEx

dsound

ord1

winmm

timeKillEvent
timeSetEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
timeGetTime

igrping

?SendPingMessage@@YA_NPADH00H@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 9.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LBMPEG_D
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee3f94b98f03c220f4d083375380670a

Headers

File Characteristics

Imports

binkw32

granny

version

kernel32

user32

gdi32

advapi32

ole32

wsock32

ddraw

dsound

winmm

igrping

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 264KB - Virtual size: 261KB

.data Size: 100KB - Virtual size: 9.2MB

LBMPEG_D Size: 4KB - Virtual size: 1024B

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 264KB - Virtual size: 261KB

.data
Size: 100KB - Virtual size: 9.2MB

LBMPEG_D
Size: 4KB - Virtual size: 1024B

.rsrc
Size: 8KB - Virtual size: 4KB