wget[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wget.exe
Size

5.6MB
MD5

f359cce7cc261b2f95163f6b5fa46109
SHA1

4f3ffda87098501aa50dcb6bce0c060967e7ea1a
SHA256

e3ca6918e62ecd7694785536c917aa06d35edf5d67170d979d88eb1a921fe2af
SHA512

f6878c09a997a3386afe79c6899da64faaf0544f7af64c0493bc5f7a07211b5f98ccd1ec212b824cf2f05b9c56f17c6ecc3a7ba5ad043545f610d124093cd8e0
SSDEEP

98304:UHYSI2mmBOXDvLFTHIOHsIVPmBAUZLe0:GI2hOzpTbHp8Vy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wget.exe

Files

wget.exe
.exe windows x64

e0b8ae0db3fc6bac170dd23870665be5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
GetUserNameW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
PFXImportCertStore

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkA
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCommandLineA
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNamedPipeInfo
GetNumberOfConsoleInputEvents
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetVersionExA
GetVolumeInformationW
GetWindowsDirectoryA
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MoveFileExA
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
PeekConsoleInputA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTitleA
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_chdir
_chmod
_close
_dup
_dup2
_endthreadex
_environ
_errno
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fmode
_fullpath
_get_osfhandle
_getch
_getcwd
_getmaxstdio
_getmbcp
_getpid
_gmtime64
_initterm
_isatty
_isctype
_localtime64
_lock
_lseeki64
_mkdir
_mkgmtime64
_onexit
_open
_open_osfhandle
_pipe
_putenv
_read
_rmdir
_setjmp
_setmaxstdio
_setmode
_stat64
_stricmp
_strnicmp
_telli64
_time64
_ultoa
_unlink
_unlock
_vsnprintf
_waccess
_wassert
_wfindnext64
_wfullpath
_wopen
_write
abort
atoi
bsearch
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
puts
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tmpfile
tolower
toupper
towlower
towupper
ungetc
vfprintf
wcscat
wcscpy
wcslen
wcstombs
_wfindfirst64
_findnext64
_tzname
longjmp
_write
_tzset
_strnicmp
_strdup
_setmode
_read
_putenv
_open
_isatty
_getpid
_fileno
_dup
_close
_stricmp

shell32

SHGetSpecialFolderPathW

user32

DispatchMessageA
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage

ws2_32

WSAAddressToStringA
WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASend
WSASetLastError
WSASocketW
WSAStartup
WSAStringToAddressW
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getservbyname
getservbyport
getsockname
htonl
htons
inet_addr
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e0b8ae0db3fc6bac170dd23870665be5

Headers

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcrt

shell32

user32

ws2_32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.data Size: 32KB - Virtual size: 32KB

.rodata Size: 1024B - Virtual size: 576B

.rdata Size: 2.2MB - Virtual size: 2.2MB

.pdata Size: 102KB - Virtual size: 101KB

.xdata Size: 97KB - Virtual size: 97KB

.bss Size: - Virtual size: 79KB

.idata Size: 14KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.text
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 32KB - Virtual size: 32KB

.rodata
Size: 1024B - Virtual size: 576B

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.pdata
Size: 102KB - Virtual size: 101KB

.xdata
Size: 97KB - Virtual size: 97KB

.bss
Size: - Virtual size: 79KB

.idata
Size: 14KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B