wemod-pro-unlocker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

wemod-pro-unlocker.exe
Size

36.9MB
MD5

56bfc3a23a5d71cea1954336eaf17869
SHA1

614c86454788e06eefc4723028528133f3972547
SHA256

86b086f0197be69d26878c0caf2dc44c4b8bc056cd83ba7509a83eb00e246b91
SHA512

9fd99ce9d9cc9f88200d3015aa3f1e3591958d63b96ad0c681fd9195ae4c059b6d2b80da82b9e1e0f6f440db8ba6bdc90c815ebbd54fec71feeaf1e6deb906e0
SSDEEP

393216:Q1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfi:QMguj8Q4VfvCqFTrYm

Score

1^/10

Malware Config

Signatures

Files

wemod-pro-unlocker.exe
.exe windows:6 windows x64 arch:x64

e7134cac29b671c221f79da02a9b4309

Code Sign

87:12:ab:44:7a:f6:e5:6e:25:02:61:94:2b:fb:3d
Certificate

Issuer

CN=Fiddler Root Certificate Authority,OU=Created by http://www.fiddler2.com,O=Progress Telerik Fiddler

Not Before

21/09/2023, 22:00

Not After

29/09/2033, 00:46

Subject

CN=Fiddler Root Certificate Authority,OU=Created by http://www.fiddler2.com,O=Progress Telerik Fiddler

Key Usages

KeyUsageCertSign

42:c9:c3:a7:04:92:d8:5a:31:d8:bb:8f:c6:c8:ec:14:8a:ca:05:68:8d:ae:94:45:d9:2c:ef:0b:b4:e2:f7:8e
Signer

Actual PE Digest

42:c9:c3:a7:04:92:d8:5a:31:d8:bb:8f:c6:c8:ec:14:8a:ca:05:68:8d:ae:94:45:d9:2c:ef:0b:b4:e2:f7:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\User\source\repos\wemod-pro-unlocker\cli\target\debug\deps\wemod_pro_unlocker.pdb

Imports

advapi32

SystemFunction036

kernel32

CloseHandle
lstrlenW
GetStdHandle
GetConsoleMode
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
AcquireSRWLockExclusive
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentProcess
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
GetModuleHandleA
GetProcAddress
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
CopyFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

bcrypt

BCryptGenRandom

ntdll

NtReadFile
RtlNtStatusToDosError
NtCreateFile
NtWriteFile

vcruntime140

__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memcmp
memset
memmove
__CxxFrameHandler3
memcpy

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_initterm
_initialize_narrow_environment
_configure_narrow_argv
exit
_exit
_get_initial_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initterm_e
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36.4MB - Virtual size: 36.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7134cac29b671c221f79da02a9b4309

Code Sign

87:12:ab:44:7a:f6:e5:6e:25:02:61:94:2b:fb:3dCertificate

Key Usages

42:c9:c3:a7:04:92:d8:5a:31:d8:bb:8f:c6:c8:ec:14:8a:ca:05:68:8d:ae:94:45:d9:2c:ef:0b:b4:e2:f7:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ole32

shell32

bcrypt

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 453KB - Virtual size: 453KB

.rdata Size: 36.4MB - Virtual size: 36.4MB

.data Size: 512B - Virtual size: 936B

.pdata Size: 26KB - Virtual size: 25KB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 7KB - Virtual size: 6KB

87:12:ab:44:7a:f6:e5:6e:25:02:61:94:2b:fb:3d
Certificate

42:c9:c3:a7:04:92:d8:5a:31:d8:bb:8f:c6:c8:ec:14:8a:ca:05:68:8d:ae:94:45:d9:2c:ef:0b:b4:e2:f7:8e
Signer

.text
Size: 453KB - Virtual size: 453KB

.rdata
Size: 36.4MB - Virtual size: 36.4MB

.data
Size: 512B - Virtual size: 936B

.pdata
Size: 26KB - Virtual size: 25KB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 7KB - Virtual size: 6KB