WOHSM
Static task
static1
Behavioral task
behavioral1
Sample
3cbabda2a7fab8e23c32bb27c30a233d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3cbabda2a7fab8e23c32bb27c30a233d.dll
Resource
win10v2004-20231222-en
General
-
Target
3cbabda2a7fab8e23c32bb27c30a233d
-
Size
564KB
-
MD5
3cbabda2a7fab8e23c32bb27c30a233d
-
SHA1
5b14c423f76badcd8840e9d9c4fc6259b8d10531
-
SHA256
22ae8cf21c245941c847c81b338138bb053bd4fc6b2e3aad40ca47884853582e
-
SHA512
c98180315fb1fc5eb53f1b5213324a579c3ca5695922080ff26dd2319373726c34d27f5bf2db9328480a55028eb054acf096015bc775b2b66e1affc38578f1d0
-
SSDEEP
12288:teor4qZmjGW52d7bMBa+q1Z2v6ypzRz6Td6OvmKW7RkJn:teor9ZYV5i7Oiix1Rz6TonVtkJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cbabda2a7fab8e23c32bb27c30a233d
Files
-
3cbabda2a7fab8e23c32bb27c30a233d.dll windows:4 windows x86 arch:x86
bf84eb251ba579a9cdb495565b3a51bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointer
CreateFileA
LeaveCriticalSection
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
lstrcpyA
CreateFileMappingA
FreeLibrary
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcessId
VirtualAlloc
WriteProcessMemory
GetModuleFileNameA
CloseHandle
VirtualProtect
user32
GetWindow
GetWindowThreadProcessId
IsWindowVisible
IsWindow
GetTopWindow
CallNextHookEx
GetKeyState
RegisterClassExA
GetClassNameA
GetClassInfoExA
SetParent
MapWindowPoints
SetWindowPos
OpenClipboard
ShowWindow
CloseClipboard
SendDlgItemMessageA
wsprintfA
GetDlgItemTextA
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EnableWindow
SetWindowTextA
DestroyWindow
PostQuitMessage
GetWindowTextA
KillTimer
GetDlgItem
SendMessageA
SetClipboardData
GetWindowRect
EmptyClipboard
advapi32
RegSetValueExA
RegOpenKeyA
RegCloseKey
comctl32
ord17
msvcrt
free
strstr
atoi
_beginthread
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
malloc
_adjust_fdiv
_itoa
_initterm
shlwapi
PathFindFileNameA
Exports
Exports
Sections
.WOHSME Size: 196KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ