Static task
static1
General
-
Target
wnetwatcher-x64.zip
-
Size
467KB
-
MD5
3fe47b10e4255e8ad41c641ed3b3f31c
-
SHA1
0769718fe96f534f2aadbe0f7721e2d40c716a44
-
SHA256
521c7d7a46cf778ed0fea23fd4dda5f4cdd861dea16511583433c0c4ed9be837
-
SHA512
f90ed841f428a8ddb4054e401f5a59ebde0f71712c4e2c23dfc8650d21aed59ec153ed2b177a17a84228239fd3cfc192f9722aeecb6863608f24fe5721d362d7
-
SSDEEP
12288:ej6R8DswNoJxRBOsVV1hTOyjf0ICd29g5+1S88N:tWHUVVXlf0ICKg5+1By
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/WNetWatcher.exe Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WNetWatcher.exe
Files
-
wnetwatcher-x64.zip.zip
-
WNetWatcher.chm.chm
-
WNetWatcher.exe.exe windows:4 windows x64 arch:x64
c03443b37fb863ad6c65d70bccabeb49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
_fmode
_commode
__setusermatherr
strcpy
_purecall
_wcslwr
qsort
_itow
strtoul
strcmp
_initterm
__set_app_type
wcscmp
_ultow
strlen
malloc
_memicmp
free
modf
_wtoi
wcstoul
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wcsicmp
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
wcschr
wcslen
_wcsnicmp
memcmp
wcsrchr
memcpy
wcscpy
memset
wcsncat
wcscat
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_snwprintf
memmove
_c_exit
atoi
strncpy
comctl32
ImageList_ReplaceIcon
ord17
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx
ImageList_Add
ImageList_SetOverlayImage
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSAAsyncSelect
connect
WSAGetLastError
htons
WSASetLastError
WSAStartup
WSACleanup
gethostbyaddr
closesocket
winmm
mciSendStringW
kernel32
ExitProcess
DeleteFileW
GetLocalTime
GetCurrentDirectoryW
SetErrorMode
Sleep
ResumeThread
GetStdHandle
EnumResourceNamesW
GetCurrentProcessId
ReadProcessMemory
OpenProcess
EnumResourceTypesW
GetStartupInfoW
GetPrivateProfileIntW
WritePrivateProfileStringW
CreateThread
FindNextFileW
GetVersionExW
FindFirstFileW
FormatMessageW
SizeofResource
GetFileSize
GlobalLock
GetLocaleInfoW
GetTempPathW
GetTempFileNameW
GlobalUnlock
GetDateFormatW
lstrcpyW
LockResource
LocalFree
lstrlenW
GetNumberFormatW
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
CompareFileTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetPrivateProfileStringW
ExpandEnvironmentStringsW
DeleteCriticalSection
GetProcAddress
FreeLibrary
SystemTimeToFileTime
GetModuleHandleW
LoadLibraryW
FileTimeToSystemTime
GetLastError
SearchPathW
CreateProcessW
GetCurrentProcess
FindClose
GetTimeFormatW
GetFileAttributesW
WriteFile
FindResourceW
ReadFile
GetModuleFileNameW
LoadResource
CloseHandle
CreateFileW
GetWindowsDirectoryW
GlobalAlloc
LoadLibraryExW
user32
SetForegroundWindow
MonitorFromWindow
GetMonitorInfoW
DispatchMessageW
KillTimer
SetTimer
MessageBeep
DrawTextExW
GetMessageW
PostQuitMessage
TrackPopupMenu
TranslateMessage
RegisterWindowMessageW
IsDialogMessageW
DestroyMenu
GetDlgCtrlID
GetMenuItemInfoW
ModifyMenuW
LoadMenuW
GetWindowTextW
DestroyWindow
LoadStringW
EnumChildWindows
CreateDialogParamW
DialogBoxParamW
GetMenuItemCount
CheckMenuItem
GetSubMenu
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
GetDC
ReleaseDC
CreateWindowExW
SetWindowPos
SendDlgItemMessageW
EndDialog
GetDlgItem
GetWindow
GetWindowRect
GetDlgItemInt
InvalidateRect
DrawFrameControl
SetWindowTextW
UpdateWindow
EndPaint
GetWindowPlacement
SetDlgItemTextW
GetDlgItemTextW
SetDlgItemInt
SetWindowLongPtrW
BeginPaint
GetSystemMetrics
GetClientRect
DeferWindowPos
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
LoadAcceleratorsW
DefWindowProcW
LoadIconW
LoadImageW
GetSysColor
SetWindowLongW
GetWindowLongW
InsertMenuItemW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetMenuStringW
GetCursorPos
SetClipboardData
CheckMenuRadioItem
EnableWindow
MapWindowPoints
CloseClipboard
GetParent
GetMenu
EmptyClipboard
EnableMenuItem
MoveWindow
GetClassNameW
OpenClipboard
gdi32
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectW
DeleteDC
GetPixel
SetPixel
SelectObject
SetBkMode
DeleteObject
SetTextColor
CreateFontIndirectW
GetDeviceCaps
SetBkColor
GetStockObject
GetTextExtentPoint32W
SetStretchBltMode
comdlg32
FindTextW
GetOpenFileNameW
GetSaveFileNameW
ChooseFontW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
Shell_NotifyIconW
SHGetFileInfoW
ShellExecuteW
ShellExecuteExW
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
readme.txt