WPE PRO[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

WPE PRO.zip
Size

379KB
MD5

4f83399436cf152a4b046323988e122c
SHA1

1ea6681b0d6274e41358d016e78d52bc0b8dc11e
SHA256

cc9cf7baf8dd48196a5bb4244c0f3beb841fe7583ec446ce106a7c0e21001a5c
SHA512

94d9997aa91090cfffa2adba5053a8ccf0253d736cd68b991e7ace76f9a5470d9615d39fa0879a3b9c6bef9631e60723ce9f6ac8e25f1529cc670a4bd70d5005
SSDEEP

6144:NEvAGFF+pgo0XucDyNhM2hYOyfWvMT0P0wOxnpAhUfmE0c8bhLLYL2szPBAnagb8:NEvs8DyNOOYJfWi0sFpuUOE0ph6RQbLI

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WPE PRO/WPE PRO.exe
unpack001/WPE PRO/WpeSpy.dll

Files

WPE PRO.zip
.zip

Password: 12345
WPE PRO/WPE PRO.exe
.exe windows:4 windows x86 arch:x86

Password: 12345

98b100e2a4307f647d34623b73d03cf7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
gethostbyname
connect
send
inet_addr
socket
WSACleanup
WSAStartup
closesocket

wpespy

GetFilterState
SetFilter
SetClientHwnd
SetTargetPid
SetLoggingActi
SetFilterState

kernel32

LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProfileStringA
LCMapStringA
VirtualProtectEx
InterlockedExchange
GetProcAddress
GetModuleHandleA
CloseHandle
OpenProcess
GetModuleFileNameA
FreeLibrary
VirtualFreeEx
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetACP
HeapSize
TerminateProcess
GetFileType
SetStdHandle
GetLocalTime
GetSystemTime
GetTimeZoneInformation
ExitThread
CreateThread
ExitProcess
GetCommandLineA
GetStartupInfoA
HeapReAlloc
RaiseException
HeapAlloc
HeapFree
RtlUnwind
FindResourceExA
CopyFileA
SetErrorMode
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileSize
SizeofResource
GetOEMCP
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
GetLastError
VirtualAllocEx
GetVersionExA
lstrlenA
GlobalReAlloc
GlobalUnlock
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
TlsFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
GetFileAttributesA
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
GetProfileIntA
lstrcmpA
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
SuspendThread
GlobalLock
SetThreadPriority
ResumeThread
lstrcpynA
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
SetLastError
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetSystemDirectoryA
GetTickCount
GlobalHandle
GlobalFree
Sleep
SetEvent
CreateEventA
GlobalAlloc
MulDiv
GlobalSize

user32

CharUpperA
GetAsyncKeyState
MapDialogRect
IsZoomed
SetParent
DeleteMenu
GetSystemMenu
ShowOwnedPopups
FindWindowA
GetDCEx
LockWindowUpdate
PostThreadMessageA
GetTabbedTextExtentA
DrawMenuBar
TranslateAcceleratorA
TranslateMDISysAccel
DefFrameProcA
LoadStringA
GetMessageA
TranslateMessage
ValidateRect
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
GetWindowDC
SendDlgItemMessageA
MapWindowPoints
DispatchMessageA
SetActiveWindow
AdjustWindowRectEx
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
GetTopWindow
MessageBoxA
WinHelpA
wsprintfA
GetMenu
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
GetWindowTextLengthA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
EndDialog
GetLastActivePopup
GetForegroundWindow
SetWindowPos
IsIconic
GetWindowPlacement
RegisterWindowMessageA
CallWindowProcA
SetWindowLongA
IsRectEmpty
EqualRect
GetDoubleClickTime
ShowScrollBar
IsChild
GetWindowTextA
SetFocus
PostQuitMessage
SetForegroundWindow
LoadIconA
GetDlgItem
PeekMessageA
BringWindowToTop
IsWindowVisible
EnumWindows
AppendMenuA
CreatePopupMenu
UpdateWindow
GetClassNameA
GetCaretPos
MessageBeep
RegisterClassA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
EmptyClipboard
RegisterClipboardFormatA
SetScrollInfo
EnableScrollBar
CreateCaret
DragDetect
SetScrollPos
DestroyCaret
SetCaretPos
ShowCaret
EnableMenuItem
GetFocus
GetMessagePos
IsClipboardFormatAvailable
GetKeyState
IntersectRect
IsWindow
SetRect
DrawEdge
GetDC
ReleaseDC
GetClipCursor
ClipCursor
InvertRect
SetRectEmpty
GetClassInfoA
DefWindowProcA
GetSystemMetrics
GetCapture
RedrawWindow
LoadBitmapA
BeginPaint
EndPaint
PostMessageA
FillRect
LoadMenuA
GetIconInfo
DrawStateA
CopyRect
FrameRect
DrawFocusRect
GetSubMenu
TrackPopupMenuEx
ClientToScreen
CreateDialogIndirectParamA
SetCursorPos
UnpackDDElParam
ReuseDDElParam
SetMenu
LoadAcceleratorsA
GetMessageTime
DefMDIChildProcA
WindowFromPoint
GetActiveWindow
SetCursor
GetParent
GetNextDlgTabItem
SendMessageA
GetWindowLongA
DestroyIcon
DestroyCursor
DestroyMenu
KillTimer
InflateRect
ReleaseCapture
PtInRect
OffsetRect
GetSysColorBrush
LoadImageA
LoadCursorA
RegisterClassExA
SetWindowRgn
DrawIconEx
DrawFrameControl
GetDesktopWindow
GetWindowRect
SystemParametersInfoA
SetTimer
GetCursorPos
ScreenToClient
SetCapture
EnableWindow
GrayStringA
DrawTextA
TabbedTextOutA
GetSysColor
InvalidateRect
GetClientRect
IsWindowUnicode
CharNextA
DefDlgProcA
ExcludeUpdateRgn
HideCaret
UnregisterClassA
GetWindow

gdi32

GetTextExtentPoint32A
GetDeviceCaps
AbortDoc
EndDoc
EndPage
StartPage
StartDocA
GetCharWidthA
SetBoundsRect
SetViewportOrgEx
GetViewportOrgEx
GetTextColor
PatBlt
CreateHalftonePalette
CreatePalette
GetDIBColorTable
RealizePalette
FillRgn
GetClipBox
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
GetCurrentObject
SetTextAlign
GetCurrentPositionEx
PolylineTo
GetViewportExtEx
GetWindowExtEx
CreatePatternBrush
SetRectRgn
CreateRectRgnIndirect
StretchDIBits
SetAbortProc
CreateDCA
CopyMetaFileA
EnumFontFamiliesExA
GetNearestColor
GetStretchBltMode
GetPolyFillMode
GetTextAlign
GetBkMode
GetROP2
GetTextFaceA
GetWindowOrgEx
CreateBitmap
SetBkColor
SetTextColor
DeleteDC
SelectObject
DeleteObject
OffsetRgn
FrameRgn
CreateRoundRectRgn
CreateRectRgn
CombineRgn
GetStockObject
GetObjectA
CreateFontIndirectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreatePolygonRgn
Rectangle
CreateFontA
GetTextMetricsA
CreateSolidBrush
CreatePen
Polygon
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
GetMapMode
DPtoLP
GetBkColor
GetTextExtentPointA
LineTo
CreateDIBitmap
BitBlt

comdlg32

GetFileTitleA
GetOpenFileNameA
PrintDlgA
CommDlgExtendedError
GetSaveFileNameA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegCloseKey
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegSetValueA
RegCreateKeyA
RegQueryValueExA

shell32

DragQueryFileA
DragFinish
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
ExtractIconA

comctl32

ImageList_AddMasked
ord14
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_SetBkColor
ord17
ord13
ImageList_Destroy
ImageList_Create
ImageList_DrawIndirect
PropertySheetA
DestroyPropertySheetPage
ImageList_Draw
CreatePropertySheetPageA

oledlg

ord8

ole32

OleFlushClipboard
OleSetClipboard
CoTaskMemFree
CoFreeUnusedLibraries
OleUninitialize
OleIsCurrentClipboard
CreateStreamOnHGlobal
OleGetClipboard
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
CoRegisterMessageFilter
RevokeDragDrop
CoRevokeClassObject
OleDuplicateData
OleInitialize
CoTaskMemAlloc
ReleaseStgMedium

Sections

.text
Size: 568KB - Virtual size: 564KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WPE PRO/WpeSpy.dll
.dll windows:4 windows x86 arch:x86

Password: 12345

c8bf43826d3943b2eea961ec88d9c3f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
InterlockedIncrement
TlsSetValue
TlsAlloc
TlsFree
GetModuleHandleA
CreateThread
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
VirtualProtect
FlushInstructionCache
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
RtlUnwind
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc

user32

RegisterWindowMessageA
IsWindow
DefWindowProcA
DispatchMessageA
TranslateMessage
SendMessageA
DestroyWindow
UnregisterClassA
RegisterClassA
MessageBoxA
CreateWindowExA
GetMessageA

wsock32

ntohs
inet_addr
getpeername
getsockname
send

Exports

Exports

GetFilterState
SetClientHwnd
SetFilter
SetFilterState
SetLoggingActi
SetTargetPid

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.WPEPRO_
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WPE PRO/robocraft.spt

Sharing

General

Malware Config

Signatures

Files

Password: 12345

Password: 12345

98b100e2a4307f647d34623b73d03cf7

Headers

File Characteristics

Imports

ws2_32

wpespy

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

Sections

.text Size: 568KB - Virtual size: 564KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 24KB - Virtual size: 160KB

Shared Size: 4KB - Virtual size: 4B

.rsrc Size: 100KB - Virtual size: 98KB

Password: 12345

c8bf43826d3943b2eea961ec88d9c3f0

Headers

File Characteristics

Imports

kernel32

user32

wsock32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 12KB - Virtual size: 13KB

.WPEPRO_ Size: 120KB - Virtual size: 118KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 568KB - Virtual size: 564KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 24KB - Virtual size: 160KB

Shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 100KB - Virtual size: 98KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 12KB - Virtual size: 13KB

.WPEPRO_
Size: 120KB - Virtual size: 118KB

.reloc
Size: 8KB - Virtual size: 5KB