�E����ZI���U�[|p͐���2���<��N��iɥr�Ƥ7�YR3<W����j'��(!���f��:� g�H ȁ+h����Z/̐_��r"�� >!����}�qCZ_P��<��W�1`�����unj�����������L���d;��!��Xll�~�krgh ���Ҧu t��Ġfr4s;�#���7�<��-�)kH�b��o��͆�z�r�OC��*����}���cU�I:&!Qu�N�� MJ d�wE���.� QVHZc��:DJX�p�1���`�����{�ND���k�������X�!�����u7]���9m(�fc$-�%j��ܫS�� ��y�B�Bu��gޭ��І���E�}�"��g7@�J�, ��]�%S�k���[۪��ΒL`ވO�W��v��<m@R��G��?2}��Q�$V!�Zm���f��<� $䋩��{H��|�7R�s��H�>�zY���W��j�<r�XQ�e��ԿF����x�+��o.� _S�����/=�n�Χ�����KB������S�%�/�,z�JA�O���Eʪ ���g����lʡv#���Dd�Y :`T2q߫���B�]>L����E��}���"�{�'���Nc`0�ڎa/ �|�~����W��k���JH�Lp��xoT���Jz� Ul6�&ہ�5��K��ہA*�W�붭9��K�N.��aR���g��Q����S���-�N�Cp�^����T�R)�a��v-��s�0����Ҁ`�j�����P��'`�̯`i��R�ݑ>�m��R@')϶�0��LԈ�D�vP�$�����K�I|6�ź�F�H�����㉗$}[��Fz�"��� ��G�h �����k��Y�2�=��拏��*���#�g�o`H��eV[p���eX �v�� �DzI�`/_�h���Z�� HUB��$��{k���O�<��y���Du�s�>��\_����KC$�?J$:1ɛ�e{%8�����f�v{K�Cr$��x2����du��� ���l�U8��EE(��*U�#�b��{s3�����x����m 4���δ\�ܓ�yf9�j��_t��]�͌�y5�vp �����`l82e��hA��=ڿ~���p����@'Ճݽ�W��m�d����o'#'���U�6��@�h���%�*�/�Ǣ+��|7��uՂ:)yF $�$�A�H�?����E���Eљs���-v��_z&s���Q����ϴ!�?�31D�& 7d�ȹh��Q��W��J���Y�7/�*.Vi�Pz��*G�V�lϵ�mc������l5�;���8���?|��]�2!���\])��7�|����b�CS���X-Ȓ*܃�o�ǽ���d.�-&�hN.@���¬ɟr���hz�{���"!����[�{+Z�LV����'c������ �3�OŸ���b��=�˧�I^��3g£��N�zo`�U��*sF~ˤ$��=�%9����=U����T��a6m��Yt���Y��7�U������ ���}8&������@ƾ�e�_�e?�odi�,?)�PL +#�a#�����0z��}#�(,�IJ����s��� <��9�$`���Y0x��ذG���p��3:� ���8aG���֝3x,���%}nߍOy~�?U�$4�UI��`9�=7)1N��9����s�CȠM������·��������Ν:�.�����V�>sѥ�� W�>N�߲2��4 ���ni����������I���u��H�.8��uP��d�?��@�N1�a��}P�SګH�6!����:�?!�I� ���?��E���>_A�6-�p�$�?�#�/�E��H��5�V���q�+-|���}]l�ǒD���;)D��!!�[k��Ч�O0ݏ���}0�[���?���@��"yH����}�}L�[�x����7];��ơ�t��H���Ԏ� ���b>v+�#�p���4@t�I^Wt�_��ډ6^�m,�5������0�"� ����{O�-��j���&��EWƅb}���H)� ���a�'K,���Rm0������C�q}r��]�>��� G':~?Y[���+JF-���Wz]g�`L�����3(x�'f�Y&M"Cl[�<%]� ę��Hy.5�<��Ϥ>�a�?�i��w�OU�����æ��F Y��\�]�7{�9q��u�qQ�p�sF�p���!�l0r���g������h����A���M$;\_�\D9�1?^�cŦ%��^��SM ���ُh#L� ;�`�Xr�x��M �j����Bc�� ٻ��]v��x��af���������<��� O"���0l�ёf[��n�$7#[9״��,��= ރ�:�l�.���QՕ�z2�b�B��ҙ����ȼ�� �Ta@`�D�֪LJ4WI!$�ex[��Z�U�F�z�3�e:b�%z3�Wb̒�CD 3�E�W��%���Rv�� P��l��ȣ�̈́a)�.�O�I�������c�n�C,U���^b�F����`+A�0^KM�E-|<n3�/�iy0?����XS�.;b��\�K��-a�Օ�Q1Xd�>�u�g����'E�[4��Ab��ޮ�C�{A2&��a��l���[�^�\D�u�����Za{�n��5����v��0�,T��`m�~�[���j��i��'K�W�M[����:mB3��^�D�I��������n�6��E��:�ֿL��!CLƟܺڔ�h�Wʕ� J��㬯������GQvy�ή���%g#=(kE|����a�WbYgY���S_��!����d��l������W�U�Fj,Ũ�sU�������\�S��Ռ}(�����F�����������{�uP�F�\��]5v�[�;b4�(�M<��=��Y���&~���A"���Y�lp�y$�X�e��^C\'��Yn�*�V�>ر$�� �c��B1��$v��R�w��A�X� ��܃�1)Ut�M�
Static task
static1
Behavioral task
behavioral1
Sample
WilcomKeyGen.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
WilcomKeyGen.exe
Resource
win10v2004-20240508-en
General
-
Target
WilcomKeyGen.exe.infected
-
Size
8.3MB
-
MD5
92936a88b6aab8d9751a088d511b0da1
-
SHA1
13788df57e50adf3f3565f410983e7d637b5d461
-
SHA256
82f20354b3384904bfe2f2f7c0ffff52c543978993726aa4520748f7afeb1bfe
-
SHA512
833d141259fda463480255002c67b91912db97756d5b41c6c97e0f6ca23cea20f44cd3e74cbe97896db46df94c8595c5f99464b09c1b7c225867f722b45a786a
-
SSDEEP
196608:FYNUtBcut5GjSGrJfg6N3ewNZsdazYch4n8qYEUwD4Y3BxS:qNsNt5G7r7Nuc8G4n8qrJM8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WilcomKeyGen.exe.infected
Files
-
WilcomKeyGen.exe.infected.exe windows:6 windows x64 arch:x64
b95094caecf555281c552525141bac6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WideCharToMultiByte
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Atn0 Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Atn1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ