AworexChams[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AworexChams.exe
Size

43.2MB
MD5

51b3770cf29fa9cd170717901f9d5bf2
SHA1

483615ae4f7382efb4a9273c3fc00cd51ac97924
SHA256

76aebc922460f0ce457c1013162927fc2787f4dfa36db22cbf0108c48c3b47d5
SHA512

24a34d242e3c76c32e7118aab0cd9f15b06ae7c0e41e5abd6b63e917bf232c4151a56b4e5e3d5de121d2bee231f7bb93d6d99aad95bfb3aff477f8f7d8d4da8d
SSDEEP

786432:iwMhGcmQGBsYALvDe9P+2IFkd1EGDmWVH9nW2rpdNA6PI5RL70FPYH8UL:qhloBsJLvC9+2Ib5W77rpdNA6wHL72Y5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AworexChams.exe

Files

AworexChams.exe
.exe windows:6 windows x64 arch:x64

4673cf22cfc649d8739ec781aa7d1f48

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetCursor

gdi32

GetDeviceCaps

advapi32

SetSecurityInfo

imm32

ImmReleaseContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

d3d9

Direct3DCreate9

psapi

GetModuleInformation

normaliz

IdnToAscii

wldap32

ord200

crypt32

CertCloseStore

ws2_32

gethostname

rpcrt4

UuidCreate

userenv

UnloadUserProfile

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strspn

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

shell32

ShellExecuteA

Sections

>lmTJ4IA
Size: - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

$Pu0+T?1
Size: - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

&4eGs<6^
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

KWOsR(xu
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RENUa2Xj
Size: - Virtual size: 26.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

:iW.r)pv
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

L,P[p)&k
Size: 43.2MB - Virtual size: 43.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRN!d-[z
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

twfpWdSA
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4673cf22cfc649d8739ec781aa7d1f48

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

msvcp140

d3d9

psapi

normaliz

wldap32

crypt32

ws2_32

rpcrt4

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

Sections

>lmTJ4IA Size: - Virtual size: 736KB

$Pu0+T?1 Size: - Virtual size: 186KB

&4eGs<6^ Size: - Virtual size: 3.6MB

KWOsR(xu Size: - Virtual size: 32KB

RENUa2Xj Size: - Virtual size: 26.6MB

:iW.r)pv Size: 5KB - Virtual size: 4KB

L,P[p)&k Size: 43.2MB - Virtual size: 43.2MB

TRN!d-[z Size: 512B - Virtual size: 296B

twfpWdSA Size: 512B - Virtual size: 480B

>lmTJ4IA
Size: - Virtual size: 736KB

$Pu0+T?1
Size: - Virtual size: 186KB

&4eGs<6^
Size: - Virtual size: 3.6MB

KWOsR(xu
Size: - Virtual size: 32KB

RENUa2Xj
Size: - Virtual size: 26.6MB

:iW.r)pv
Size: 5KB - Virtual size: 4KB

L,P[p)&k
Size: 43.2MB - Virtual size: 43.2MB

TRN!d-[z
Size: 512B - Virtual size: 296B

twfpWdSA
Size: 512B - Virtual size: 480B