WRusr[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WRusr.dll
Size

234KB
MD5

6fff0a18fded37c0bae3e1fd7af29269
SHA1

5ceb570be1fa6affcd96ef0665f60d3b6eeb4eb2
SHA256

8ee5bd6fea98577bd29c15055e96ec17c62ca415f4a5d26065b25a922b19d3b1
SHA512

6c38d82de78af80ef2ef4899d08932fe4994e68fd56551b59b9a86dc41513a6fec41a33258d6ecb131b01e5e5b9a4ab34231701815e71d0ee6f7705ac136e2dc
SSDEEP

3072:5ngk4CpRoFdZLNy9TvFu/nB11YOlYvXnHVugOUP+W3cmcOggN32XnGzotJJ0xAyW:ppGk9x41YOlYvXHOUPvByGzoiGy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WRusr.dll

Files

WRusr.dll
.dll regsvr32 windows:6 windows x64 arch:x64

be0c4f7e38089fe7168ec2ccb03364a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\GitLab-Runner\builds\qr55KSHn\1\endpoint\windows\WindowsSecurity\Allegro\Binary\Release\9.0.35\17\x64\wrusr.pdb

Imports

psapi

GetModuleFileNameExW

shlwapi

ord388

msimg32

TransparentBlt
AlphaBlend

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetCurrentProcessId
VirtualFree
GetCommandLineW
WaitForSingleObject
GetExitCodeThread
CloseHandle
CreateThread
SetErrorMode
CallNamedPipeW
Sleep
WriteProcessMemory
GetModuleHandleA
OpenProcess
LoadLibraryW
GetProcAddress
VirtualAllocEx
ExitProcess
CreateRemoteThread
GetModuleFileNameW
FormatMessageW
LocalFree
CreateMutexA
GetLastError
SizeofResource
FindResourceA
LockResource
GetNativeSystemInfo
LoadResource
CreateProcessW
QueryPerformanceCounter
LoadLibraryExW
ProcessIdToSessionId
DisableThreadLibraryCalls
MultiByteToWideChar
SetUnhandledExceptionFilter
WideCharToMultiByte
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetStringTypeW
GetFileType
GetStdHandle
GetModuleHandleExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RaiseException
GetStartupInfoW
SetThreadContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetFilePointerEx
SetStdHandle
HeapSize
FlushInstructionCache
GetThreadContext
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetCurrentThread
ResumeThread
SuspendThread
GetCurrentProcess
GetTickCount
VirtualAlloc
GetModuleHandleW
VirtualQuery
GetCurrentThreadId
VirtualProtect
CreateFileW
WriteConsoleW
LCMapStringW
GetVersionExA

user32

LoadImageW
InsertMenuW
GetAncestor
UpdateWindow
InvalidateRect
FillRect
IsWindow
SetTimer
GetClientRect
BeginPaint
EndPaint
EnableWindow
FindWindowW
RegisterWindowMessageA
DefWindowProcW
RegisterShellHookWindow
LoadCursorW
GetMessageW
GetWindow
DestroyWindow
SetWindowPos
SetWindowLongPtrW
GetSysColor
UnregisterClassW
GetWindowLongPtrW
GetWindowPlacement
ShowWindow
DispatchMessageW
GetWindowInfo
RegisterClassW
SetLayeredWindowAttributes
TranslateMessage
GetWindowRect
IsWindowVisible
GetClassNameA
LoadStringW
WindowFromDC
GetClipboardData
SetClipboardData
GetWindowLongW
GetWindowThreadProcessId
PostMessageW
EnumChildWindows
SendMessageW
WaitForInputIdle
EnumWindows
GetClassNameW
GetWindowTextW
MessageBoxW
MessageBoxA
CreateWindowExW
InsertMenuItemW
PostQuitMessage

gdi32

GetStockObject
StretchBlt
PlgBlt
CreateDCW
MaskBlt
CreateDCA
CreateBitmap
SetBkColor
GetObjectW
BitBlt
DeleteDC
CreateCompatibleDC
SelectObject
SetTextColor

advapi32

RegCloseKey
IsValidSid
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW

shell32

DragQueryFileW
SHGetFolderPathW

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SynExp
SynProc
SynProc2

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be0c4f7e38089fe7168ec2ccb03364a8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

shlwapi

msimg32

kernel32

user32

gdi32

advapi32

shell32

ntdll

Exports

Exports

Sections

.text Size: 146KB - Virtual size: 145KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 12KB - Virtual size: 55KB

.pdata Size: 9KB - Virtual size: 8KB

_RDATA Size: 512B - Virtual size: 384B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 146KB - Virtual size: 145KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 12KB - Virtual size: 55KB

.pdata
Size: 9KB - Virtual size: 8KB

_RDATA
Size: 512B - Virtual size: 384B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 2KB