wrapper-windows-x86-64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

wrapper-windows-x86-64.exe
Size

772KB
MD5

49732620ee9949df34470cb5ff70db3b
SHA1

01f8430f57f761e4dfe23dde1adb447fb1da38f0
SHA256

7e089d2b8373997588279512db1e469ed0332f0a7b733142d7fd9dc9d8e39be8
SHA512

30623a45cb11f193189a34dee7dce1959e33a93bc872334ccf1b65c7cecc7e425eeccbecef271b68ec715d4a7a9886bc4c984d9f66c2f10a62a9fc916ba997a8
SSDEEP

12288:AyPbdcCXeVVnT/VJ6wh4mGTpjJ4FUIzBIvt+po:AyPbdcCXeVZtJ6vHTpjaFUrvt2o

Score

1^/10

Malware Config

Signatures

Files

wrapper-windows-x86-64.exe
.exe windows:5 windows x64 arch:x64

70ddfa7e389dab7359005924dc47e9f3

Code Sign

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/11/2020, 00:00

Not After

18/11/2023, 23:59

Subject

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/11/2020, 00:00

Not After

18/11/2023, 23:59

Subject

CN=Tanuki Software Ltd.,O=Tanuki Software Ltd.,POSTALCODE=134-0088,STREET=6-18-10\, Nishi-Kasai,L=Edogawa-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:37:fb:9d:af:c0:67:96:8c:74:04:92:bb:93:4a:5b:24:7a:f6:08:6f:bb:8a:7b:2b:d5:c8:c9:5e:ad:c9:0d
Signer

Actual PE Digest

49:37:fb:9d:af:c0:67:96:8c:74:04:92:bb:93:4a:5b:24:7a:f6:08:6f:bb:8a:7b:2b:d5:c8:c9:5e:ad:c9:0d

Digest Algorithm

sha256

PE Digest Matches

true

ea:36:70:ce:77:10:55:d0:34:2a:d0:79:46:5d:14:64:04:12:05:9b
Signer

Actual PE Digest

ea:36:70:ce:77:10:55:d0:34:2a:d0:79:46:5d:14:64:04:12:05:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.51-st\src\c\wrapper64_VC8__Win32_Release\wrapper.pdb

Imports

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetUniversalNameW

shell32

ShellExecuteExW

netapi32

NetWkstaGetInfo
NetApiBufferFree

wsock32

accept
recv
WSAGetLastError
sendto
WSAStartup
inet_ntoa
gethostname
listen
htons
ntohs
ioctlsocket
bind
socket
closesocket
send

ws2_32

freeaddrinfo
getaddrinfo
getnameinfo

shlwapi

PathIsDirectoryW
PathFindOnPathW

advapi32

ChangeServiceConfigW
RegCloseKey
LsaClose
QueryServiceStatus
StartServiceW
LookupAccountSidW
ChangeServiceConfig2W
LookupPrivilegeValueW
LookupAccountNameW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
LsaAddAccountRights
ReportEventW
DeregisterEventSource
RegCreateKeyW
RegisterEventSourceW
LsaFreeMemory
RegSetValueExW
RegCreateKeyExW
QueryServiceConfigW
ConvertSidToStringSidW
AdjustTokenPrivileges
ControlService
RegisterServiceCtrlHandlerW
LsaNtStatusToWinError
RegOpenKeyExW
IsValidSid
RegEnumValueW
CreateServiceW
LsaRemoveAccountRights
CloseServiceHandle
OpenProcessToken
LsaQueryInformationPolicy
IsWellKnownSid
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
LogonUserW
LsaOpenPolicy
OpenServiceW
LsaEnumerateAccountRights
GetTokenInformation
SetServiceStatus

user32

GetSystemMetrics
LoadStringW
DispatchMessageW
GetWindow
GetWindowThreadProcessId
DestroyWindow
SetWindowPlacement
GetWindowRect
IsIconic
GetTopWindow
GetKeyState
SetForegroundWindow
FindWindowW
TranslateMessage
GetForegroundWindow
RegisterClassExW
GetWindowPlacement
SystemParametersInfoW
PeekMessageW
ShowWindow
CreateWindowExW
IsWindowVisible
UpdateWindow
DefWindowProcW

crypt32

CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateChain
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CertGetCertificateChain
CryptMsgGetParam

wintrust

WinVerifyTrust

pdh

PdhCollectQueryData
PdhOpenQueryW
PdhGetFormattedCounterValue

psapi

GetModuleFileNameExW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
StringFromCLSID
CoTaskMemFree

oleaut32

SysFreeString

activeds

ord3

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersAddresses

kernel32

GetDriveTypeA
LCMapStringW
SetHandleCount
GetStartupInfoA
CreateFileA
WriteConsoleA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetEnvironmentVariableA
GetStringTypeW
SetFilePointer
GetCommandLineW
GetTickCount
LCMapStringA
GetCurrentDirectoryA
DeleteCriticalSection
RtlUnwindEx
GetModuleFileNameA
HeapCreate
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandle
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
HeapReAlloc
HeapSize
SetEndOfFile
FindNextFileW
MoveFileW
ExitProcess
GetFileType
SetStdHandle
LeaveCriticalSection
EnterCriticalSection
ReadConsoleInputW
ReadConsoleInputA
GetConsoleCP
DeleteFileW
GetSystemTimeAsFileTime
SetCurrentDirectoryW
SetEnvironmentVariableW
FindFirstFileW
FindClose
GetProcessHeap
CompareStringA
HeapAlloc
HeapFree
GetTimeZoneInformation
WriteConsoleW
GetVersionExW
GetFullPathNameW
CreateMutexW
PeekNamedPipe
FreeLibrary
GetEnvironmentStringsW
WaitForSingleObject
ConnectNamedPipe
GetModuleHandleW
CreateNamedPipeW
WriteFile
OpenProcess
WideCharToMultiByte
LoadLibraryW
GetConsoleMode
GetLocaleInfoW
RaiseException
SetConsoleMode
TerminateProcess
ReadFile
GetACP
MultiByteToWideChar
SetThreadLocale
GetStdHandle
GetLastError
SetLastError
GetThreadLocale
GetProcAddress
IsValidCodePage
Process32FirstW
GetSystemInfo
GetOEMCP
Process32NextW
SetConsoleTitleW
FreeEnvironmentStringsW
CreateToolhelp32Snapshot
ReleaseMutex
CloseHandle
GetSystemDefaultLangID
GetEnvironmentVariableW
GetFileSize
lstrcmpA
SetPriorityClass
GetDriveTypeW
AllocConsole
GetCPInfo
GetSystemDefaultUILanguage
CreateProcessW
EndUpdateResourceW
GetCurrentProcess
QueryPerformanceCounter
SetEvent
GenerateConsoleCtrlEvent
WaitNamedPipeW
GlobalAlloc
Sleep
CopyFileW
GetConsoleWindow
FormatMessageW
GetExitCodeProcess
FileTimeToSystemTime
GetModuleFileNameW
CreateFileW
lstrlenW
GetStartupInfoW
DisconnectNamedPipe
FlushFileBuffers
GetConsoleOutputCP
GetCPInfoExW
GetCurrentDirectoryW
BeginUpdateResourceW
GlobalFree
GetLocalTime
ProcessIdToSessionId
LocalAlloc
SetConsoleCtrlHandler
GlobalMemoryStatusEx
CreateEventW
SetNamedPipeHandleState
CreatePipe
UpdateResourceW
QueryPerformanceFrequency
GetUserDefaultUILanguage
GetCurrentThreadId
DuplicateHandle
FileTimeToLocalFileTime
GetCurrentProcessId
LocalFree
lstrcpyW
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW

Sections

.text
Size: 449KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70ddfa7e389dab7359005924dc47e9f3

Code Sign

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5eCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5eCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

49:37:fb:9d:af:c0:67:96:8c:74:04:92:bb:93:4a:5b:24:7a:f6:08:6f:bb:8a:7b:2b:d5:c8:c9:5e:ad:c9:0dSigner

ea:36:70:ce:77:10:55:d0:34:2a:d0:79:46:5d:14:64:04:12:05:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

shell32

netapi32

wsock32

ws2_32

shlwapi

advapi32

user32

crypt32

wintrust

pdh

psapi

ole32

oleaut32

activeds

version

iphlpapi

kernel32

Sections

.text Size: 449KB - Virtual size: 449KB

.rdata Size: 246KB - Virtual size: 245KB

.data Size: 7KB - Virtual size: 218KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 3KB - Virtual size: 2KB

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

bf:de:76:64:f1:1a:d5:f3:dd:af:a7:e4:d7:c7:0f:5e
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

49:37:fb:9d:af:c0:67:96:8c:74:04:92:bb:93:4a:5b:24:7a:f6:08:6f:bb:8a:7b:2b:d5:c8:c9:5e:ad:c9:0d
Signer

ea:36:70:ce:77:10:55:d0:34:2a:d0:79:46:5d:14:64:04:12:05:9b
Signer

.text
Size: 449KB - Virtual size: 449KB

.rdata
Size: 246KB - Virtual size: 245KB

.data
Size: 7KB - Virtual size: 218KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 3KB - Virtual size: 2KB