wakuoo-1-0-0-9000[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

wakuoo-1-0-0-9000.exe
Size

4.3MB
MD5

5f36b916421f7335c976f87fe0e50fd6
SHA1

c1bad390ca42765ea19e11d89151522a21a11b54
SHA256

9f64ee35615981119f3378ba3cf36c5e5625bda075a75995e768faa6ac70ac5e
SHA512

fc6797ffe571fb8ef8c9ab555899f3d97bcf5bef44994e114f88199da1ae66023579574397de39e3a8e9ce7787967f5f950720de65a1adfbb1349da2277e5224
SSDEEP

98304:ZVGol7EOWFwUpID5j3oc3HZSb3e/oOCslfeJfyA:7Gol7EOHUcBoy5SrpOCslfeJfyA

Score

1^/10

Malware Config

Signatures

Files

wakuoo-1-0-0-9000.exe
.exe windows:5 windows x86

d0ef04d433899001fb9176116f4a891c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:e0:46:08:98:41:74:2e:8e:77:19:01:67:90:62:2b
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29/10/2021, 00:00

Not After

22/11/2022, 23:59

Subject

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

83:02:f8:35:3d:3f:24:1e:f3:0c:71:5b:cf:ad:5b:7a:dc:fe:58:14:f9:0a:f9:e6:88:4d:7e:8d:f9:c9:ea:49
Signer

Actual PE Digest

83:02:f8:35:3d:3f:24:1e:f3:0c:71:5b:cf:ad:5b:7a:dc:fe:58:14:f9:0a:f9:e6:88:4d:7e:8d:f9:c9:ea:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedExchange
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExA
InterlockedExchangeAdd
GetCurrentThreadId
GetPrivateProfileStringA
GlobalMemoryStatusEx
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetSystemDefaultLangID
GetUserDefaultLCID
DecodePointer
ExitProcess
LoadLibraryExW
GetCommandLineW
GetEnvironmentVariableA
GetDriveTypeW
SetEvent
ResetEvent
CreateFileA
GetFileTime
GetLocalTime
CompareFileTime
GetModuleFileNameA
CreateDirectoryA
SetFileAttributesA
SetEndOfFile
QueueUserWorkItem
GetSystemTimeAsFileTime
GetSystemInfo
GetACP
FormatMessageA
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryW
VerifyVersionInfoW
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
CreateProcessW
FormatMessageW
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
InitializeCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetTickCount
FindClose
ReadFile
WaitForSingleObject
Process32FirstW
FindFirstFileExA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetFullPathNameW
GetTimeZoneInformation
FlushFileBuffers
HeapSize
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
GetFileAttributesExW
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetStringTypeW
CreateToolhelp32Snapshot
FindNextFileA
FindFirstFileA
DeleteFileA
QueryDosDeviceW
RemoveDirectoryA
SetCurrentDirectoryW
GetTempFileNameW
Process32NextW
FindNextFileW
FindFirstFileW
CreateThread
GetCurrentProcessId
WideCharToMultiByte
DeleteFileW
WritePrivateProfileStringW
SetFileAttributesW
CreateFileW
lstrlenW
CloseHandle
WriteFile
LocalFree
LocalAlloc
InterlockedDecrement
FindResourceW
SizeofResource
LoadResource
GlobalFree
GlobalUnlock
OutputDebugStringW
GetLogicalDriveStringsW
CreateEventW
lstrcatW
lstrcpyW
lstrcmpiW
CreatePipe
SetHandleInformation
GetFileSize
Sleep
DebugBreak
GetExitCodeProcess
OpenProcess
InterlockedIncrement
GetCurrentDirectoryW
SetFilePointer
GetFileType
GetCurrentProcess
GetDiskFreeSpaceExW
GetTempPathW
lstrlenA
LoadLibraryW
GetProcAddress
FreeLibrary
SystemTimeToFileTime
GetSystemTime
GetVersionExW
MultiByteToWideChar
GetVolumeInformationW
WriteConsoleW
MoveFileExW
RemoveDirectoryW
GetLastError
CreateDirectoryW
GlobalLock
GlobalAlloc
LockResource
FreeResource
GetModuleHandleExW

user32

GetWindowRect
SendMessageW
LoadStringW
ReleaseDC
GetDC
FillRect
RegisterClipboardFormatW
RegisterWindowMessageW
FindWindowW
EnumDisplaySettingsW
TrackMouseEvent
IsIconic
IsWindowEnabled
MapWindowPoints
CopyRect
SetWindowPos
GetSystemMetrics
GetParent
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
PeekMessageW
AttachThreadInput
GetForegroundWindow
SetForegroundWindow
MessageBoxW
CharNextW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
CallWindowProcW
GetClassInfoExW
IsWindow
ShowWindow
SetFocus
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SetWindowLongW
LoadCursorW
BeginPaint
EndPaint
InvalidateRect
DrawIcon
DrawTextW
LoadImageW
DrawIconEx
GetFocus
GetKeyState
GetClientRect
UpdateWindow
GetMessagePos
IsZoomed
EnableWindow
SetWindowRgn
ScreenToClient
OffsetRect
SetClassLongW
GetWindow
ChangeDisplaySettingsW
GetProcessWindowStation
MonitorFromWindow
GetMonitorInfoW
GetUserObjectInformationW
SystemParametersInfoW

gdi32

SetViewportOrgEx
SetBkColor
MoveToEx
GetObjectA
SetTextColor
RoundRect
Rectangle
LineTo
SetBkMode
GetTextExtentPoint32W
CreateSolidBrush
SetWindowOrgEx
DeleteObject
CreateFontW
CreateCompatibleBitmap
GetObjectW
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreatePen
StretchBlt

advapi32

RegDeleteValueW
RegCreateKeyExW
RegCloseKey
CreateWellKnownSid
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
SystemFunction036

shell32

ShellExecuteW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
CommandLineToArgvW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString
VariantClear

shlwapi

PathFindExtensionW
PathIsDirectoryW
PathIsRootW
PathAppendA
PathCombineA
PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
PathCanonicalizeW
StrCmpIW
StrStrIW
PathFileExistsW
PathRemoveFileSpecA

comctl32

InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectI
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetTextRenderingHint
GdipReleaseDC
GdipSetImageAttributesColorKeys
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipTranslateTextureTransform
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipClonePath
GdipCreatePath
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdiplusStartup
GdipFree
GdipAlloc

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetOpenA
InternetSetOptionW
InternetOpenUrlA
HttpOpenRequestW
HttpSendRequestA
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetCloseHandle

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

getsockopt
htons
ntohs
setsockopt
WSASetLastError
getsockname
WSAStartup
WSACleanup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
getnameinfo
getpeername
connect
closesocket
bind
send
recv
socket
WSAGetLastError
WSAIoctl
shutdown

wldap32

ord133
ord79
ord142
ord167
ord147
ord301
ord127
ord27
ord118
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord26

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0ef04d433899001fb9176116f4a891c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:e0:46:08:98:41:74:2e:8e:77:19:01:67:90:62:2bCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

83:02:f8:35:3d:3f:24:1e:f3:0c:71:5b:cf:ad:5b:7a:dc:fe:58:14:f9:0a:f9:e6:88:4d:7e:8d:f9:c9:ea:49Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wininet

iphlpapi

psapi

crypt32

winmm

bcrypt

ws2_32

wldap32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 595KB - Virtual size: 595KB

.data Size: 32KB - Virtual size: 64KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 95KB - Virtual size: 94KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:e0:46:08:98:41:74:2e:8e:77:19:01:67:90:62:2b
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

83:02:f8:35:3d:3f:24:1e:f3:0c:71:5b:cf:ad:5b:7a:dc:fe:58:14:f9:0a:f9:e6:88:4d:7e:8d:f9:c9:ea:49
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 595KB - Virtual size: 595KB

.data
Size: 32KB - Virtual size: 64KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 95KB - Virtual size: 94KB