Ŏ �r���H��cE�|'�[>�:'�x��C��'t���QH!g�g.��4����)����wM�L���4�=���ަ��7u�:'\���d�O:[�V�oyN�܂��!@���vg�Z4����h�)��,xtkY�^�]̬���M(�:?�Sa��)B��~��U~ߞ��\��+([�]aՑ��K zE�m4��z�`dC�"]|)W}Ւ�6��;ˠ"��k#�.�:���.S\x��(~����茜_��ވW�.J�| �7טY�v'%�q7��G�fQ �,�9(�3�A�����۸Ehȝ�����ܿσ8v� �!!м 운*�z�K��<hw�K�B��m�b����~��0V+���<ӄh�_�h���nh�eU�q�>����t͏6�^�إQ`�U�6'�g�o� A� ˋ�^&/)��&���Ŕ�8�%�K%��i�S�<�q��6�"�w��/���G�����l�C��k��t��2��K<ɬ!i\��"�-q�xAhy[�F7� b�����*����E��j8W ��}ˠ��)D� "]���߮�AЖڶ���ִ0�-� jv�mD�gS#��x�Ǧ����7bi���t[��/��Ϭ�v��2A!�t�/���NvR:Ȅ�K�� �X&y��6]Ȟn��>��z��x\@��L��=�*'�ƈ�������n?��ad�ZA���<�`R��|Y��gaPwL�7��-� me�f�)E�\ �Y:�1&����H��������+@u� E���v2`���Nͼ;�)88c�0���h��pE¹*+��Na�����'��#�UJ$^Q� �W�6L���Zf�*kŞ�HXM��6��s:`N7+7?3@j��6���Z���w�s�艾w%BB��e�/��.��!��ܨ�T�;i��sD3�� Q�Um�M�/��\Ǟӵ9����鞤 �F�t��m�|�F��.=�w����DѲ�:�ᾈ���j�i�-lC��@i����;�S���yKw��#B��0���>v$@�t�9F@�l��ےc^���������@sYMX�C�A\wl�0R��� ,��wHm�����MA �Wm����]c�w�oJ �ix,�����o��el^��- �U#� |��m�h\���s'��:��_N �m���Β��v�1U�i3/�_ ��dc�I?�[����x4�����Y��D3���pи8T*�{��ܷR��j��К��"�A#;*��� �mUơKş���xĒ�C���GZ++�)ی��i�B��hK�=F+P�z)8hT�NG�X�A��=�hS��'�P��� Q�3�����?�_@�����\>--�ʤ�Q��U�+)���dž�A0�@��Q/c�i��$y���ړ�Z�q@����h�.��dt��Q��B'(̡�&ft��A��������5�B�cr`o,�萃�W2t�SH����?VT�j��� �"g����C�4��D�� 1�^��I����c��|h�;�v��O>.E�ƺA6:���[bO���=m�R5�8�W)���V�h���_��It��҈m�n��M��S�-��0@8ڞ1��r��b��<�������aM�u�͋� ��q�@ҒLVt���I��_�Sͺz�����k��./#r|�o��ۦ<2��ז��!Dk��+���VD�%G��A&{�3A<*�6��7�G`�+d����-����p��<m��at��[o��i�h��&.�����rM�n���]c�=˝|�"�e��U���̸�X���W�w�r�շ�c�F S��L��NZ=:# �����L��� h*ھn�9�����Q�<�g���/o��Q�� �� m�t2}�Z��4���9#��~i��\r;*��({;���}�U�fs(�j5ݙ J���E��!��EML�����p#�*A����B@�#�r%X��ϻ��D���t�Φ�,�|�B�:��@�$���%cւ~&V�����:�g(f�*�Y�yT����]^7�U��s �xV�%>��uQ��#�YR��|��<f��àӅ&<���$��m�FV2�ꑈ�e�E�~���h{��_D⇎�G���t��)F�J��N!������"-���2gw�������/��f &W��O���Vzb��� 6Q�H�lA�votC��H��3�7(T�B)�{} +���nm��Ve8��W[&�E���WQb��p8���y�Z䓤¼��Y���Ѐ��4&�>���2!,79 �Q����<o���K^��C8 [���X�/ѣ���IXnM�S���^&�l�2��(�2�8�ov���#��Ś�,�Î�*�4�cį��l[�����_�ˠ⇚ԦaTH�K(��;���s�k�7����a�C�T�Duk�#�\��!��F� ���J��+���Et����������h.�����*ݡ�5ڻ�y7�.�1��f����Ha�����i�RQ�sǧ�ٛSƦ���b�f��Ls_���:�/l��9�y?������F=ź�Ư�D����?����p� EBy�i�$��&�(�q���ߩ���:�]���JbN�AߜQ�\o^�1�5����BW�z=�54�ZٝB��:�-�X�I���рj֣o�� �5M ��O��YOѪ�����/dC���@|Z�m0zc����ی��ԂlM��i����A��� ��?Z6)ʍ�q���tS`I�ԆUkd<R�*�'�T��G .�����S�e�M�%X�0��� &�f���k9^��V��C ����}j{!�+e^8�a��k0��,�zt0��sӔdg�y>7%�#�H$K<5��U�F�=_8�������=S�n\k�ZY��|~�H�4 ���W�S1�����1 Ce�2�%6A�9A։<,Xv��w��3��ZP�p�_�> �R���Ůg�%R�����3��Q}��q.戶�0�\H�f�6%���5�"s��O�#�3mp�D�c̏�f�t�*Ș����:��,.A{q�D#GDa�R�k�w��T\�2�5��3�����)
Static task
static1
Behavioral task
behavioral1
Sample
WaveCall.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WaveCall.exe
Resource
win10v2004-20240611-en
General
-
Target
WaveCall.exe
-
Size
5.7MB
-
MD5
12f1fddc1386dd0554daca17461b16f5
-
SHA1
3c40f865adc55ffcf4d7e4d87069cd55172832fd
-
SHA256
f88095510af72e5317413270b7ff9e5f37cfc16bc0fe469283add6faaef1fe27
-
SHA512
ea5631bc5d37d5331086469bbb4d71ba43f9b8adec8207734db28beed22911c8c99c058b2a378b02f75500e281720034c6dc0d67faccf7fc1daa68a5ea3a12fc
-
SSDEEP
98304:trl9UJLXuq5dHjvplYT+FQcpnk8+Bnffrlv0bPTyim2P2xIKV+IBWq:trrUqq5dHjvbYSFQUk82fr50yiZ2SKsG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WaveCall.exe
Files
-
WaveCall.exe.exe windows:6 windows x64 arch:x64
b2fb3b48f68b3d51f240bd8193720349
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
VerifyVersionInfoA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextA
imm32
ImmReleaseContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertOpenStore
ws2_32
gethostname
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 700KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 810KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.er0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.er1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ