Wild[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Wild.exe
Size

10.5MB
MD5

41dcf63c36511ee933c7c9cb59754a2e
SHA1

c2512ec6c71d0c9e7a0e6fbf6333b666de0aea03
SHA256

3502a04c2929586795e7da2cdf9112cbe13e6aa2d9901efed128abb042fa91db
SHA512

90e2877e3c15f12eb9106de65b5584aed3cac5634c959d4478252f4d78caec4109cd82d7a7644b42cf28f287c6bad22f8d36126c21ee88376d5dd5e7941edadb
SSDEEP

196608:Yv0lqd06wEwX2IQiQ5pjVsFNu0UhZ5tO96XfB+xuB4J0VpOSrZOthLapPA:Y8t1sbynwo6vkxx0zhZOtQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Wild.exe

Files

Wild.exe
.exe windows:6 windows x64 arch:x64

71f0d5ae45753907ec15891ab864cdaa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualQuery
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetCursorPos

advapi32

CryptEncrypt

shell32

ShellExecuteA

oleaut32

SysAllocString

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_c_exit

api-ms-win-crt-stdio-l1-1-0

fopen

api-ms-win-crt-math-l1-1-0

acosf

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

ws2_32

ntohl

wldap32

ord167

crypt32

CertOpenStore

Sections

.text
Size: - Virtual size: 723KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71f0d5ae45753907ec15891ab864cdaa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

msvcp140

d3d11

d3dx11_43

dwmapi

imm32

d3dcompiler_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

ws2_32

wldap32

crypt32

Sections

.text Size: - Virtual size: 723KB

.rdata Size: - Virtual size: 163KB

.data Size: - Virtual size: 2.5MB

.pdata Size: - Virtual size: 33KB

Size: - Virtual size: 5.8MB

Size: 5KB - Virtual size: 4KB

Size: 10.4MB - Virtual size: 10.4MB

.reloc Size: 512B - Virtual size: 124B

.rsrc Size: 82KB - Virtual size: 82KB

.text
Size: - Virtual size: 723KB

.rdata
Size: - Virtual size: 163KB

.data
Size: - Virtual size: 2.5MB

.pdata
Size: - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 124B

.rsrc
Size: 82KB - Virtual size: 82KB