reWASD[.]zip | Triage™

General

Target
reWASD.zip
Size 22.5MB
Sample240613-d9q9matake
SHA256 77284b66201602f29b3a17e96aa78d60b4b8581c8e0bdbe1d3de0a6b4d46b1cb
MD5 526ad40e5098e6b02067c4c80671ee42
SHA1 97b2e254da16aaea60b57e1e496b594f16ea8612
SHA512 26cc39a29e95ce17d84359ffb97b4a75c751190ce74e5a2dad96e6e9f50e40a22ca0a2249990fdcafc7fefccfc732fe3671f54c356cf29e39bf596f0a13fc0e2
SSDEEP 393216:WVBaBWGBAl9/YDf0AcBTmpYfYmpg/PN5gShHW86yRAocu2LD/U7Rb72Z:GknB6RK0AcdtYmK9RHW+RAa2//UQZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/reWASD.dll
unpack001/reWASDCommon.dll

File Explorer

reWASD.zip

.zip 22.5MB
reWASD.dll

.dll 41.1MB
reWASDCommon.dll

.dll 3.7MB

reWASD.zip

SHA256 77284b66201602f29b3a17e96aa78d60b4b8581c8e0bdbe1d3de0a6b4d46b1cb
MD5 526ad40e5098e6b02067c4c80671ee42
SHA1 97b2e254da16aaea60b57e1e496b594f16ea8612
SHA512 26cc39a29e95ce17d84359ffb97b4a75c751190ce74e5a2dad96e6e9f50e40a22ca0a2249990fdcafc7fefccfc732fe3671f54c356cf29e39bf596f0a13fc0e2
SSDEEP 393216:WVBaBWGBAl9/YDf0AcBTmpYfYmpg/PN5gShHW86yRAocu2LD/U7Rb72Z:GknB6RK0AcdtYmK9RHW+RAa2//UQZ
MD5 SHA1 SHA512 SSDEEP

reWASD.dll

SHA256 85793ef13e02a404bca367c9e16d856752d8d78f19d8348308fb38873f38b181
MD5 afae1e9402f69755b5983e702ca3d629
SHA1 ee1f88cdecd4e9afef0bba754b2a41e5f57289e2
SHA512 eb59f02101781dfcb584a0a9635bdc00bdf64a707438d9e090b0328ad19c1086c28f3f1af52a8abefd9c4fe09f05524b5a2d1cb82536dc796e785d08cf934258
SSDEEP 393216:fVOb8IDUF1XGZ7463hACbGVWb8Q5yFl54v7463hQ:fY7DUFtY75hAwGQ75yFry75hQ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

reWASDCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70c18d75b21c15b571a87461eb07f173050917b08cabe2fc45b044adc8b010e3
MD5 11ec326493c0ef3c707c74be9c4fd76b
SHA1 28ff9355c27da6897d66f81c48dac7173749e28f
SHA512 40461e00b22bd30a292e1904cc2b5f572251218e8fd6ff8077d9f5c6e081f7713df52738b52717eb388e4b807195e2567590c7ed7c952c2f20664e15be5a96d4
SSDEEP 49152:URREfAteVuuYm/oXloBtqeA/AP4u+VRbg4UvsFF:ULE4teVuuYRMtVA//uERd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3934190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

reWASD.zip

reWASD.dll

generic

reWASDCommon.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

reWASD.zip

reWASD.dll

generic

reWASDCommon.dll

mscoree

dotnet