WeMod Activator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WeMod Activator.exe
Size

44.8MB
MD5

d2ff6258897478e2c33c2197b2936442
SHA1

7705ce5be414a3a997032d0bb528894306631965
SHA256

c0952ff390e4b8a4a9aa762c892cbdc15f89940eefdc3feb7c1feaaabd2e41b8
SHA512

017cb080ef7dc1beeced5bd54a264ce468a92ead73ba19f02c01bb34641a4fa6026f68a4bcbcab43a4d8d98c80693e6176860a9690789cd33f83740807121944
SSDEEP

393216:HicuUrl/R+toV1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuG5:78IMguj8Q4VfvCqFTrY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WeMod Activator.exe

Files

WeMod Activator.exe
.exe windows:6 windows x64 arch:x64

aa48dcac5365166bc2224ce9fcb1f0a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\wufei\Desktop\cli\target\debug\deps\wemod_pro_unlocker.pdb

Imports

kernel32

DuplicateHandle
GetCommandLineW
GetCurrentProcess
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
GetCurrentProcessId
QueryPerformanceCounter
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObject
HeapReAlloc
ReleaseSRWLockShared
ReleaseMutex
GetModuleHandleA
GetProcAddress
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
SwitchToThread
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
CopyFileExW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CompareStringOrdinal
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
GetTempPathW
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
GetFileInformationByHandleEx
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetConsoleMode
CloseHandle
GetStdHandle
SetFileInformationByHandle
lstrlenW
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
IsProcessorFeaturePresent

ws2_32

getaddrinfo
send
setsockopt
WSAGetLastError
ioctlsocket
WSASocketW
WSACleanup
WSAStartup
getpeername
connect
select
getsockname
freeaddrinfo
recv
getsockopt
closesocket

secur32

DecryptMessage
FreeContextBuffer
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
EncryptMessage
InitializeSecurityContextW
AcceptSecurityContext

crypt32

CertVerifyCertificateChainPolicy
CertCloseStore
CertDuplicateStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertDuplicateCertificateContext

advapi32

SystemFunction036

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ntdll

RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtReadFile

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
memcpy
memmove
memset
memcmp
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
terminate
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 914KB - Virtual size: 914KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43.8MB - Virtual size: 43.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa48dcac5365166bc2224ce9fcb1f0a7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

secur32

crypt32

advapi32

shell32

ole32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 914KB - Virtual size: 914KB

.rdata Size: 43.8MB - Virtual size: 43.8MB

.data Size: 512B - Virtual size: 1016B

.pdata Size: 57KB - Virtual size: 57KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 914KB - Virtual size: 914KB

.rdata
Size: 43.8MB - Virtual size: 43.8MB

.data
Size: 512B - Virtual size: 1016B

.pdata
Size: 57KB - Virtual size: 57KB

.reloc
Size: 3KB - Virtual size: 3KB