WASHA FREE[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WASHA FREE.exe
Size 1.5MB
Sample240107-x9klmadeb9
SHA256 b37286ee7523b2377a7b3fd806622aa010caa305bd328d35a0784aeb28925e1c
MD5 a287ec038c5c41560d8fccf64fc11900
SHA1 53b05d9841c357859a195e728d2fd8b143530dbb
SHA512 02c4bacdb445ae6ef9a048730ce1b5479d0c0cfd6e97d63ca062637383403a02d823ddc8ab9ed675cb0504cf09e792d0018186bb6abb6036a770e03a3c7ef920
SSDEEP 24576:I3vfcW/OCQK78fuq6bKJm/qhJF8747/DMC5soMsfCmRX14SgAfIK57mRZEV7nl2u:4cuOCQK78fuq6bkpF8A/DuadfRh7mwll
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WASHA FREE.exe

File Explorer

WASHA FREE.exe

.exe 1.5MB

WASHA FREE.exe

IMPHASH 2ac0277674b79a586b516d4faec7d931
SHA256 b37286ee7523b2377a7b3fd806622aa010caa305bd328d35a0784aeb28925e1c
MD5 a287ec038c5c41560d8fccf64fc11900
SHA1 53b05d9841c357859a195e728d2fd8b143530dbb
SHA512 02c4bacdb445ae6ef9a048730ce1b5479d0c0cfd6e97d63ca062637383403a02d823ddc8ab9ed675cb0504cf09e792d0018186bb6abb6036a770e03a3c7ef920
SSDEEP 24576:I3vfcW/OCQK78fuq6bKJm/qhJF8747/DMC5soMsfCmRX14SgAfIK57mRZEV7nl2u:4cuOCQK78fuq6bkpF8A/DuadfRh7mwll
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1110204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive HeapSize WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapDestroy IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW WaitForMultipleObjects GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW FormatMessageA PeekNamedPipe GetFileType LocalFree GetStdHandle EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA SleepEx CreateFileMappingA UnmapViewOfFile GetSystemDirectoryA VerifyVersionInfoA VirtualQueryEx IsDebuggerPresent AllocConsole ReadProcessMemory DeleteCriticalSection Beep VirtualProtectEx CreateThread ReadFile HeapAlloc HeapReAlloc HeapFree GetSystemInfo CloseHandle Process32Next CreateFileA GetLastError Sleep CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx TerminateProcess GetCurrentProcess WriteProcessMemory Process32First QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetTickCount GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree MapViewOfFile GetProcessHeap SetLastError GlobalAlloc MultiByteToWideChar GetFileSizeEx GetCurrentProcessId

user32

SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow ScreenToClient DispatchMessageA GetWindowRect DestroyWindow SetCapture LoadCursorA GetKeyState UpdateWindow FindWindowA PostQuitMessage PeekMessageA LoadIconA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow SetCursor GetClientRect MessageBoxA SetWindowDisplayAffinity GetWindowLongA SetWindowLongA CreateWindowExW GetAsyncKeyState ShowWindow GetActiveWindow RegisterClassExW UnregisterClassW ReleaseCapture GetSystemMetrics IsWindowUnicode

advapi32

CryptCreateHash CopySid GetTokenInformation OpenProcessToken GetLengthSid CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA IsValidSid

ole32

CoCreateInstance CoUninitialize CoInitialize

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Random_device@std@@YAIXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

ntdll

RtlCaptureContext RtlLookupFunctionEntry NtSuspendProcess RtlVirtualUnwind NtResumeProcess

normaliz

IdnToAscii

wldap32

ord32 ord27 ord26 ord41 ord50 ord45 ord60 ord35 ord46 ord217 ord143 ord33 ord22 ord79 ord30 ord200 ord301 ord211

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCertificateChainEngine CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket htons getsockopt ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl ioctlsocket listen __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom sendto gethostname ntohl

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception strchr _CxxThrowException __intrinsic_setjmp memchr memset memmove memcpy longjmp memcmp strrchr __std_exception_destroy __std_exception_copy __std_terminate strstr

api-ms-win-crt-stdio-l1-1-0

_wfopen fread _lseeki64 ftell __acrt_iob_func fgets __stdio_common_vsscanf _set_fmode feof fflush fputs fputc fclose __stdio_common_vsprintf fseek __stdio_common_vfprintf fwrite _open _close __p__commode _write _read fopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp tolower strpbrk isupper strspn strcspn _strdup strncpy

api-ms-win-crt-heap-l1-1-0

free malloc calloc realloc _msize _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _exit _wassert _c_exit _register_thread_local_exe_atexit_callback _cexit _invalid_parameter_noinfo_noreturn exit _get_narrow_winmain_command_line system _seh_filter_exe _errno abort strerror __sys_nerr _invalid_parameter_noinfo _register_onexit_function _resetstkoflw _initialize_onexit_table _crt_atexit _initialize_narrow_environment _configure_narrow_argv _set_app_type _beginthreadex terminate _getpid

api-ms-win-crt-convert-l1-1-0

strtoull atoi strtoll strtoul strtod strtol

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-math-l1-1-0

sinf sqrt pow fmodf cosf ceilf acosf sqrtf _dclass __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64 _unlink _fstat64 _access