C:\Users\arifu\OneDrive\Masaüstü\Guardian\Guardian\Win32\Release\EXE-x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
WxiOw1t.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WxiOw1t.exe
Resource
win10v2004-20240802-en
General
-
Target
WxiOw1t.exe
-
Size
1.8MB
-
MD5
97e934075f3b78d11659f9bddfd1deab
-
SHA1
2f7fba36d6c968e67e30e4e18634d7afcf06c5bc
-
SHA256
9ab77590b3ee201435bc81efb0bb5620be5ae6cba8eac397cecb6bd783ed0a39
-
SHA512
58dadd6a197680dfa688e333d4479162c71a6340618238db40133937a7f7a6a216e69b1d7601e71889c1b0781c73b434629bf013a2e837082132f41ccf621f13
-
SSDEEP
12288:VV1gD6d+bBHSL1TmD3zpy28/m2WjPHlYtLMRgI4ZNMO0s/f23NQ4cAdBKjQfCWxn:VV1gD6uA+lFYqDk9DHqKwKjQfCWzJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WxiOw1t.exe
Files
-
WxiOw1t.exe.exe windows:6 windows x86 arch:x86
faa2b7f545faa9d8ff3b7d770929bb71
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LocalFree
GetCurrentProcessId
FreeLibrary
WideCharToMultiByte
Module32NextW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
Module32FirstW
CloseHandle
FormatMessageW
OutputDebugStringW
IsDebuggerPresent
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
LoadLibraryA
GetSystemDirectoryA
QueryPerformanceFrequency
CreateEventA
GetConsoleMode
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLocaleInfoEx
FormatMessageA
MultiByteToWideChar
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
GetSystemTimeAsFileTime
InitializeSListHead
CreateToolhelp32Snapshot
OpenProcess
K32GetProcessImageFileNameW
GetCurrentThreadId
CreateFileW
SetConsoleMode
WriteFile
GetStdHandle
SetLastError
QueryInformationJobObject
GetComputerNameA
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetLastError
Sleep
TerminateProcess
GetModuleHandleA
InitializeCriticalSectionEx
GetModuleFileNameW
GetCurrentProcess
WaitForSingleObject
GetModuleFileNameA
advapi32
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptImportKey
CryptEncrypt
CryptDestroyHash
shell32
ShellExecuteA
msvcp140
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
_Cnd_do_broadcast_at_thread_exit
?_Random_device@std@@YAIXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??Bid@locale@std@@QAEIXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??7ios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
dbghelp
ImageNtHeader
bcrypt
BCryptGenRandom
vcruntime140
__current_exception
strchr
strstr
__std_exception_destroy
__CxxFrameHandler3
memmove
_except_handler4_common
__std_exception_copy
strrchr
memchr
_CxxThrowException
memset
__current_exception_context
__std_terminate
memcpy
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
exit
terminate
abort
__sys_errlist
__sys_nerr
_errno
_configure_narrow_argv
_controlfp_s
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_initialize_onexit_table
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_pclose
_read
fgetc
_lseeki64
fgets
_open
fopen
__stdio_common_vsscanf
fwrite
__p__commode
ftell
fseek
feof
__stdio_common_vsprintf
fputs
fgetpos
setvbuf
_fileno
_close
_write
getchar
__stdio_common_vswprintf
fclose
__stdio_common_vfprintf
fflush
fputc
__acrt_iob_func
_popen
_get_stream_buffer_pointers
_set_fmode
_fseeki64
fread
fsetpos
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
free
malloc
_callnewh
_set_new_mode
calloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
_dclass
_dsign
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
strtoull
atoi
strtoll
strtod
wcstombs
api-ms-win-crt-time-l1-1-0
_localtime64
strftime
_time64
_gmtime64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_lock_file
_stat64
_access
_unlock_file
_unlink
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strspn
strcspn
strncmp
_strdup
strncpy
strpbrk
api-ms-win-crt-utility-l1-1-0
qsort
normaliz
IdnToUnicode
IdnToAscii
wldap32
ord46
ord217
ord143
ord45
ord211
ord41
ord22
ord26
ord27
ord32
ord50
ord33
ord60
ord35
ord301
ord200
ord30
ord79
crypt32
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFindExtension
ws2_32
ioctlsocket
WSACleanup
getpeername
setsockopt
ntohs
WSAGetLastError
gethostname
WSAIoctl
getsockopt
send
WSASetLastError
socket
__WSAFDIsSet
select
WSACloseEvent
WSACreateEvent
accept
bind
connect
WSAStartup
WSAWaitForMultipleEvents
getsockname
htonl
listen
WSAEnumNetworkEvents
recv
getaddrinfo
closesocket
freeaddrinfo
WSAResetEvent
WSAEventSelect
recvfrom
sendto
htons
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ