WDSync[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

WDSync.exe
Size

4.4MB
MD5

be2c2100d62c8af2ef7ffe02a3e29e79
SHA1

05e63fad9df6e5800bceef515d97b68730e8321a
SHA256

a9ea015adf6df1ac69744c2f1e6b7ee9f2be74e7dc67a850473998f9b86b8439
SHA512

8b92a4c295d8f0ad1bd2b367046a553cc313e5b8e53d7e490cbdfb66193bb3fc16bab77dbd4d04023ef8988989315236e801ba0b7413cbe51e47fe975a472a88
SSDEEP

49152:Rye8u6rKJFZB0NmCy3Gk42Nyo4b7o36PvVojxQ5s845hU643dMyBKyp+Xq/2Q9n4:Ryu6ryFNDY7n565oYyAqR9nvsALu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WDSync.exe

Files

WDSync.exe
.exe windows:4 windows x86

8864948b624a33b260714f546b0b4009

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
DeleteFileA
ExitProcess
ExitThread
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempFileNameA
GetTempPathA
GetVersionExA
LoadLibraryA
LoadLibraryExA
OpenProcess
WriteProcessMemory
VirtualAlloc
VirtualFree
WriteFile

Sections

.text
Size: 2.7MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pe
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 53KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pe
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 253KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pe
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 65KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pe
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 401KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 513KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pebundle
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8864948b624a33b260714f546b0b4009

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 2.7MB - Virtual size: 11.1MB

.rsrc Size: 69KB - Virtual size: 72KB

.pe Size: 1024B - Virtual size: 4KB

.text Size: 53KB - Virtual size: 152KB

.rsrc Size: 10KB - Virtual size: 12KB

.reloc Size: 512B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

.pe Size: 1024B - Virtual size: 4KB

.text Size: 253KB - Virtual size: 832KB

.rsrc Size: 77KB - Virtual size: 80KB

.reloc Size: 512B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

.pe Size: 1024B - Virtual size: 4KB

.text Size: 65KB - Virtual size: 400KB

.rsrc Size: 171KB - Virtual size: 172KB

.reloc Size: 512B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

.pe Size: 1024B - Virtual size: 4KB

.text Size: 401KB - Virtual size: 2.3MB

.rsrc Size: 513KB - Virtual size: 516KB

.reloc Size: 512B - Virtual size: 4KB

pebundle Size: 8KB - Virtual size: 8KB

.text
Size: 2.7MB - Virtual size: 11.1MB

.rsrc
Size: 69KB - Virtual size: 72KB

.pe
Size: 1024B - Virtual size: 4KB

.text
Size: 53KB - Virtual size: 152KB

.rsrc
Size: 10KB - Virtual size: 12KB

.reloc
Size: 512B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

.pe
Size: 1024B - Virtual size: 4KB

.text
Size: 253KB - Virtual size: 832KB

.rsrc
Size: 77KB - Virtual size: 80KB

.reloc
Size: 512B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

.pe
Size: 1024B - Virtual size: 4KB

.text
Size: 65KB - Virtual size: 400KB

.rsrc
Size: 171KB - Virtual size: 172KB

.reloc
Size: 512B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB

.pe
Size: 1024B - Virtual size: 4KB

.text
Size: 401KB - Virtual size: 2.3MB

.rsrc
Size: 513KB - Virtual size: 516KB

.reloc
Size: 512B - Virtual size: 4KB

pebundle
Size: 8KB - Virtual size: 8KB