WPDShextAutoplay[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

WPDShextAutoplay.exe
Size

29KB
MD5

ca66c2f1ddaca8a4e682917a9b833e86
SHA1

b3893cc53134c114e620f6974a145bffc7ede3cc
SHA256

af9a12c42802d18833f5ac51558305a29ce87768abd6b7ccb8a16e0834b400cd
SHA512

676313098553317c60fe7c38876db156caea4ca00603e67273e548a165464e5a93c0838bfc8def0c582a1992250c03860a814e76bf021a5eb48ad261f3869a23
SSDEEP

768:LvfNLzvihynhapMXkM+FhCeRclG2Iweejn2AX:LXNfiwaCXkR4eRclUw1yAX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WPDShextAutoplay.exe

Files

WPDShextAutoplay.exe
.exe windows x86

a2888c1c669df960fa9bf31a11ecc7ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
TraceMessage

kernel32

SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InterlockedDecrement
InterlockedIncrement
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersion
GetLastError
WaitForSingleObject
CreateEventW
CreateProcessW
SetEvent
CompareStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc

user32

SendMessageW
FindWindowW
UnregisterClassA

msvcrt

_ismbblead
??3@YAXPAX@Z
memset
_vsnwprintf
memcpy_s
_CxxThrowException
_wcsicmp
_vscwprintf
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_controlfp
_XcptFilter
_exit
_cexit
__getmainargs
free
??_U@YAPAXI@Z
??_V@YAXPAX@Z
wcschr
??2@YAPAXI@Z
__CxxFrameHandler3
wcstok
memmove_s
vswprintf_s

oleaut32

SysAllocString
SysFreeString

shlwapi

StrRStrIW

ole32

CreateBindCtx
CoRegisterClassObject
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoRevokeClassObject

setupapi

SetupDiOpenDevRegKey
SetupDiOpenDeviceInterfaceW
SetupDiGetClassDevsExW
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shell32

ord155
ShellExecuteExW
SHParseDisplayName

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2888c1c669df960fa9bf31a11ecc7ab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

oleaut32

shlwapi

ole32

setupapi

shell32

Sections

.text Size: 23KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 23KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB