Static task
static1
Behavioral task
behavioral1
Sample
WobblyLife_EasyInstaller.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
WobblyLife_EasyInstaller.exe
Resource
win10v2004-20230915-en
General
-
Target
WobblyLife_EasyInstaller.exe
-
Size
768KB
-
MD5
94a4b6bd6c49b02cae14e7382356a033
-
SHA1
2fa21f73995608ae0fa7caf1c4978644a0965b73
-
SHA256
19944253d75a851d28214afd1a24f5795fdbe08ce954ab015d470a9b35e38524
-
SHA512
f53ff5946034d4c6e3df95b83c1f730be06be8b61bd65c74fc30a5ed9d203cbbafd8f64eb3b84e6daa5cbf8c6f5d7a1d97a728846e8d8b921f88f56cd4dfd333
-
SSDEEP
24576:ulQPNf7jR+Y8D4Rm5vlRJqmIQmidQZq9:OQPNfHUY8MavlRJqmIQmK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WobblyLife_EasyInstaller.exe
Files
-
WobblyLife_EasyInstaller.exe.exe windows:6 windows x64
632af423555f90095979fcd8c22ea37b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FindClose
FindFirstFileW
GetFileAttributesExW
InitializeCriticalSection
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
Sleep
GetVersion
QueryPerformanceFrequency
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
CreateFileW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
CloseHandle
AreFileApisANSI
GetLocaleInfoEx
LocalFree
LoadLibraryA
LoadLibraryW
FreeLibrary
GetProcAddress
FormatMessageW
GetModuleHandleW
GetModuleHandleA
GetCurrentProcess
GetLastError
FormatMessageA
user32
ReleaseDC
LoadCursorW
ScreenToClient
ChangeDisplaySettingsW
DestroyIcon
CreateIcon
GetWindowThreadProcessId
EnumDisplaySettingsW
GetAsyncKeyState
GetSystemMetrics
SetWindowLongPtrW
CreateWindowExA
DestroyWindow
ShowWindow
TrackMouseEvent
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
RegisterDeviceNotificationW
DefWindowProcW
CallWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
FlashWindowEx
SetWindowPos
GetKeyState
MapVirtualKeyW
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
SetForegroundWindow
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRect
ShowCursor
SetCursor
GetCursorPos
MapWindowPoints
ClipCursor
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
GetDC
gdi32
GetDeviceCaps
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
opengl32
glGetError
glGetIntegerv
glTexSubImage2D
glGenTextures
glDeleteTextures
glBindTexture
glTexParameteri
glTexImage2D
glGetTexImage
glFlush
glVertexPointer
glTexCoordPointer
glEnableClientState
glDrawArrays
glDisableClientState
glColorPointer
glViewport
glEnable
glGetString
glMatrixMode
glLoadMatrixf
glLoadIdentity
glDisable
glClearColor
glClear
glBlendFunc
wglShareLists
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glIsEnabled
winmm
timeBeginPeriod
timeEndPeriod
joyGetDevCapsW
joyGetPosEx
timeGetDevCaps
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?narrow@?$ctype@_W@std@@QEBAD_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
__std_terminate
_CxxThrowException
__std_exception_copy
__std_exception_destroy
__intrinsic_setjmp
__current_exception_context
__current_exception
__C_specific_handler
strrchr
memchr
longjmp
memset
memcmp
strstr
memmove
memcpy
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
realloc
malloc
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initterm
_set_app_type
_seh_filter_exe
_initterm_e
terminate
exit
_exit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
system
__p___argc
_get_initial_narrow_environment
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
isdigit
strcmp
api-ms-win-crt-math-l1-1-0
floorf
sinf
cosf
sqrtf
powf
__setusermatherr
ldexp
api-ms-win-crt-convert-l1-1-0
strtol
atol
api-ms-win-crt-stdio-l1-1-0
fread
fopen
feof
fclose
fopen_s
ftell
fwrite
__stdio_common_vsprintf
fseek
_set_fmode
__p__commode
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Sections
.text Size: 542KB - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ