WoW[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

WoW.exe
Size

4.6MB
MD5

ccf83146dbb3d10ef826aa4de178a5be
SHA1

893def24f703fd18c1514d31b92f00e616d8375f
SHA256

b4756d38ef207c02ed651f4952bd89a70b4857b73a33413339e1b285b28d2dc7
SHA512

4198fa57ecec4dd80850f4d37be71759344c31dac03733db68828e4ce60b70c8e6bf42950a43b313a4578d75964e939de50a880e913b337aa713edf88bdbdd08
SSDEEP

98304:2VHDmkVkJignCnW2SIPFXxmrn94ZQNPL7NI:WHhVkJignCncI9hmrnLhNI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WoW.exe

Files

WoW.exe
.exe windows:4 windows x86

8ded295f64664d3227658d5b9adea810

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ResumeThread
SetThreadAffinityMask
GetSystemInfo
GetComputerNameA
GlobalMemoryStatus
CreateEventA
DeleteFileA
GetTempPathA
GetThreadPriority
SetThreadPriority
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
GetFileTime
SetFileTime
SetEndOfFile
FindClose
DuplicateHandle
SuspendThread
CreateIoCompletionPort
QueryPerformanceFrequency
GetQueuedCompletionStatus
QueryPerformanceCounter
WaitForSingleObject
SetEvent
TerminateThread
PostQueuedCompletionStatus
WaitForMultipleObjects
CreateFileA
GetSystemDirectoryA
Beep
IsBadReadPtr
GetCurrentProcessId
CreateThread
GetProcessHeap
GetExitCodeProcess
FindFirstFileA
GetFileAttributesA
CreateDirectoryA
FormatMessageA
SetUnhandledExceptionFilter
OutputDebugStringA
UnmapViewOfFile
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
MapViewOfFile
CreateFileMappingA
GetDiskFreeSpaceA
FileTimeToSystemTime
GetDriveTypeA
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
OpenMutexA
ReleaseMutex
FindNextFileA
lstrcpynA
MulDiv
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetStdHandle
IsBadCodePtr
GetWindowsDirectoryA
FreeLibrary
InterlockedExchange
SetEnvironmentVariableA
CompareStringA
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidLocale
Sleep
GetStringTypeA
LCMapStringA
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
IsBadWritePtr
VirtualAlloc
GetOEMCP
GetACP
RaiseException
SetConsoleCtrlHandler
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapSize
HeapAlloc
HeapReAlloc
WriteFile
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
FileTimeToLocalFileTime
GetLocalTime
GetTickCount
CompareFileTime
GetSystemTime
SystemTimeToFileTime
FlushInstructionCache
VirtualQuery
GetVolumeInformationA
GetEnvironmentVariableA
GetCurrentThread
GetLastError
TlsGetValue
SetLastError
GetModuleHandleA
IsProcessorFeaturePresent
LocalFree
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualProtect
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
InterlockedCompareExchange

advapi32

GetUserNameA
FreeSid
SetSecurityInfo
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
GetTokenInformation
OpenProcessToken
AllocateAndInitializeSid
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegDeleteValueA
RegFlushKey
RegEnumKeyExA
RegOpenKeyA
RegCloseKey

comctl32

ImageList_DragEnter
ImageList_GetImageCount
ImageList_Add
ImageList_Replace
ImageList_Destroy
ImageList_Create
_TrackMouseEvent
InitCommonControlsEx
ImageList_DragMove
ImageList_BeginDrag
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragShowNolock

user32

SetMenu
CreateDialogIndirectParamA
SetMenuItemInfoA
InsertMenuItemA
GetMenuItemCount
DeleteMenu
GetFocus
GetMenu
SetTimer
KillTimer
IsWindowEnabled
GetParent
SetWindowPos
CreateWindowExA
IsDialogMessageA
GetWindow
IsWindowVisible
InvalidateRect
LoadImageA
GetWindowInfo
SetWindowTextA
DestroyAcceleratorTable
SetClipboardData
EmptyClipboard
GetWindowTextA
GetWindowTextLengthA
ReleaseDC
GetDC
GetSysColorBrush
GetSysColor
GetClassLongA
CloseClipboard
OpenClipboard
DrawTextA
FillRect
SetScrollInfo
SetScrollPos
GetScrollInfo
LoadCursorA
SetCursor
ShowCursor
DestroyIcon
SetClassLongA
CreateAcceleratorTableA
TrackPopupMenu
DrawMenuBar
FrameRect
DrawIconEx
InvertRect
LoadBitmapA
wsprintfA
LoadStringA
IsWindow
MessageBoxA
WaitForInputIdle
MapWindowPoints
GetSystemMetrics
MonitorFromRect
GetMonitorInfoA
BeginPaint
EndPaint
RegisterClassExA
UnregisterClassA
ChangeDisplaySettingsExA
ClipCursor
EnumDisplaySettingsA
EnumDisplayDevicesA
GetKeyState
MessageBeep
WindowFromPoint
SetWindowPlacement
GetWindowPlacement
GetForegroundWindow
BringWindowToTop
GetMenuItemInfoA
DestroyMenu
CreatePopupMenu
CreateMenu
TranslateAcceleratorA
DestroyWindow
PostMessageA
ShowWindow
IsZoomed
PostQuitMessage
SetFocus
SendMessageA
MoveWindow
ReleaseCapture
SetCapture
MapVirtualKeyA
DefWindowProcA
SendInput
GetAsyncKeyState
GetClientRect
GetCursorPos
ScreenToClient
SystemParametersInfoA
ClientToScreen
SetCursorPos
IsIconic
GetWindowRect
AdjustWindowRectEx
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayout
GetActiveWindow
SetParent

shell32

FindExecutableA
ShellExecuteA

wsock32

WSACleanup
bind
connect
gethostbyname
inet_ntoa
WSAStartup
recvfrom
getpeername
htons
accept
getsockname
listen
setsockopt
socket
WSAGetLastError
closesocket
select
send
__WSAFDIsSet
recv
ioctlsocket
ntohs
inet_addr
ntohl
gethostname
getsockopt
sendto

opengl32

glGetError
glLineWidth
glDrawElements
glDrawArrays
glTexSubImage2D
glTexEnvfv
glTexEnviv
glHint
glMaterialfv
glMaterialf
glAlphaFunc
glFogi
glFogf
glFogfv
glDepthFunc
glPointSize
glTexGenfv
glLightModelfv
glLightModeli
glColorMaterial
glPixelStorei
glClipPlane
glLoadMatrixf
glLoadIdentity
glPolygonMode
glLightfv
glLightf
glViewport
glDepthRange
glScissor
glColor4fv
glVertexPointer
glNormalPointer
glColorPointer
glTexCoordPointer
glDepthMask
glColorMask
glTexGeni
glTexEnvi
glTexEnvf
glEnableClientState
glDisableClientState
glPolygonOffset
glMatrixMode
glBlendFunc
glCullFace
glFinish
wglSwapLayerBuffers
glClearColor
glClear
glGetString
glTexParameteri
glEnable
glBindTexture
glDeleteTextures
glDisable
glTexImage2D
glGetIntegerv
glGetFloatv
glReadPixels
wglGetCurrentDC
glGenTextures
glCopyTexImage2D
glCopyTexSubImage2D
wglGetProcAddress
wglCreateContext
wglDeleteContext
wglMakeCurrent
wglGetCurrentContext

gdi32

SetBkMode
CombineRgn
CreateRectRgnIndirect
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
ChoosePixelFormat
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
CreateRectRgn
CreateFontIndirectA
GetObjectA
FillRgn
CreateDIBSection
DeleteDC
BitBlt
CreateCompatibleDC
SetPixel
SetTextColor
SetBkColor
CreateDIBitmap
DeleteObject
SelectObject
GetTextExtentPoint32A
GetStockObject
TextOutA
GdiFlush
LineTo
GetBkColor
CreateSolidBrush
SetMapMode
MoveToEx
CreatePen

imm32

ImmSetConversionStatus
ImmAssociateContext
ImmGetCandidateListA
ImmNotifyIME
ImmGetCompositionStringA
ImmGetContext
ImmGetConversionStatus
ImmReleaseContext
ImmAssociateContextEx

divxdecoder

UnInitializeDivxDecoder
InitializeDivxDecoder
SetOutputFormat
DivxDecode

winmm

joyGetPosEx
joyGetDevCapsA
joyGetNumDevs

fmod

_FSOUND_GetMaxChannels@0
_FSOUND_GetMixer@0
_FSOUND_GetDriverName@4
_FSOUND_GetDriver@0
_FSOUND_GetOutput@0
_FSOUND_GetNumHWChannels@12
_FSOUND_File_SetCallbacks@20
_FSOUND_GetError@0
_FSOUND_SetMemorySystem@20
_FSOUND_SetMaxHardwareChannels@4
_FSOUND_SetMinHardwareChannels@4
_FSOUND_SetHWND@4
_FSOUND_SetBufferSize@4
_FSOUND_SetMixer@4
_FSOUND_GetDriverCaps@8
_FSOUND_SetDriver@4
_FSOUND_GetNumDrivers@0
_FSOUND_SetOutput@4
_FSOUND_GetVersion@0
_FSOUND_SetMute@8
_FSOUND_Close@0
_FSOUND_StopSound@4
_FSOUND_Update@0
_FSOUND_3D_Listener_GetAttributes@32
_FSOUND_3D_SetAttributes@12
_FSOUND_Stream_PlayEx@16
_FSOUND_Stream_SetLoopCount@8
_FSOUND_IsPlaying@4
_FSOUND_SetReserved@8
_FSOUND_Stream_GetLengthMs@4
_FSOUND_Stream_SetTime@8
_FSOUND_Reverb_SetChannelProperties@8
_FSOUND_SetVolume@8
_FSOUND_SetFrequency@8
_FSOUND_Sample_SetMinMaxDistance@12
_FSOUND_Stream_GetSample@4
_FSOUND_3D_Listener_SetAttributes@32
_FSOUND_Reverb_SetProperties@4
_FSOUND_Reverb_GetProperties@4
_FSOUND_GetCPUUsage@0
_FSOUND_SetSFXMasterVolume@4
_FSOUND_SetPaused@8
_FSOUND_GetOutputRate@0
_FSOUND_3D_SetDistanceFactor@4
_FSOUND_3D_SetDopplerFactor@4
_FSOUND_3D_SetRolloffFactor@4
_FSOUND_Stream_GetTime@4
_FSOUND_Stream_Stop@4
_FSOUND_Stream_Close@4
_FSOUND_Stream_Open@16
_FSOUND_Stream_SetEndCallback@12
_FSOUND_Stream_Play@8
_FSOUND_Init@12

wininet

InternetReadFileExA
HttpQueryInfoA
InternetSetOptionA
InternetSetStatusCallback
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetCloseHandle

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 368KB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ded295f64664d3227658d5b9adea810

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

user32

shell32

wsock32

opengl32

gdi32

imm32

divxdecoder

winmm

fmod

wininet

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 160KB - Virtual size: 156KB

.data Size: 368KB - Virtual size: 4.8MB

.sxdata Size: 4KB - Virtual size: 8B

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 160KB - Virtual size: 156KB

.data
Size: 368KB - Virtual size: 4.8MB

.sxdata
Size: 4KB - Virtual size: 8B

.rsrc
Size: 40KB - Virtual size: 36KB