OW2-External[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

OW2-External.exe
Size

10.5MB
MD5

ac6100136e5013d3616642ae4a7fb48a
SHA1

e0c3e5a9c5ce63c720979057b404d87035aaf59f
SHA256

c881a2c861eb08babfb54c4d209ab4a11d0401bc7c819657ac3f11e4bf37daa1
SHA512

38d66d8b6a82c0ef402509274dd6ad825b97b258da2a8a9994e20421b2459831d5e719fb0b4f0691549ebb4eace537f3bbecfcd0de58ca38d1fa7c9fb9881c2f
SSDEEP

196608:wWOcylqz99OyMwv+yiVgCMrEN4ntqxkhsXJ7bb0Ek6SW6bLoiEVMWl:wh+qyj2gCMrXpsXQj/EO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OW2-External.exe

Files

OW2-External.exe
.exe windows:6 windows x64 arch:x64

05c547e74370cfdd3a7455abea2fada5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileType
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetClientRect
CharUpperBuffW

advapi32

CryptDestroyHash

shell32

ShellExecuteA

imm32

ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

_Mtx_destroy_in_situ

d3d11

D3D11CreateDeviceAndSwapChain

normaliz

IdnToAscii

wldap32

ord22

crypt32

CertFreeCertificateChainEngine

ws2_32

htonl

rpcrt4

UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-math-l1-1-0

ldexp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 1016KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.V.f
Size: - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.>S8
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.6^b
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05c547e74370cfdd3a7455abea2fada5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_43

dwmapi

msvcp140

d3d11

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 1016KB

.rdata Size: - Virtual size: 3.3MB

.data Size: - Virtual size: 14KB

.pdata Size: - Virtual size: 35KB

.V.f Size: - Virtual size: 6.9MB

.>S8 Size: 6KB - Virtual size: 5KB

.6^b Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1016KB

.rdata
Size: - Virtual size: 3.3MB

.data
Size: - Virtual size: 14KB

.pdata
Size: - Virtual size: 35KB

.V.f
Size: - Virtual size: 6.9MB

.>S8
Size: 6KB - Virtual size: 5KB

.6^b
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 512B - Virtual size: 480B