wompwomp[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

wompwomp.exe
Size

59KB
MD5

11c2355ae66099dcf09baa4ab5ea6586
SHA1

bdd160dd3b5a241563cff7b4285e7f902442e58e
SHA256

55f61e00db69e9a866ddbdd7d5fd8dc3c52799d0db790481e04e3426468091de
SHA512

23242677b674810945a070d3ff851570ffba09ec753a842888d3aaba9a253c2699861f66a4bcdec478ac6295e84b78025a101f3ed78d5dc6eb6abca82f792754
SSDEEP

768:NHnKOt1rJZhONUrMeJ5shJEHZGTYKaogXLKd+cEk672iRPS:NK+1rVONUwew7EH0zasdFEk672ixS

Score

1^/10

Malware Config

Signatures

Files

wompwomp.exe
.exe windows:5 windows x64 arch:x64

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

12/07/2021, 00:00

Not After

11/07/2024, 23:59

Subject

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0b:f5:2d:39:12:08:a7:81:9a:9f:b3:b6:91:1d:16:b9:d1:e0:cf:15:bd:a0:d9:d8:df:fd:51:be:d6:a5:30:f0
Signer

Actual PE Digest

0b:f5:2d:39:12:08:a7:81:9a:9f:b3:b6:91:1d:16:b9:d1:e0:cf:15:bd:a0:d9:d8:df:fd:51:be:d6:a5:30:f0

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\x64_dbg\bin\x64\x64dbg_exe.pdb

Imports

kernel32

GetProcAddress
GetCurrentProcess
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
GetCurrentThreadId
GetLastError
IsDebuggerPresent
CloseHandle
GetLocalTime
LoadLibraryA
GetModuleHandleA
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
QueryPerformanceCounter
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

user32

MessageBoxW
LoadStringW
MessageBoxA

x64bridge

BridgeStart
BridgeInit

msvcp120

?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcr120

__crtSetUnhandledExceptionFilter
_XcptFilter
wcscat_s
_set_purecall_handler
_set_invalid_parameter_handler
vswprintf_s
?set_terminate@@YAP6AXXZP6AXXZ@Z
signal
_purecall
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memmove
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CxxFrameHandler3
memcpy
_vsnprintf_s
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_CxxThrowException
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

0b:f5:2d:39:12:08:a7:81:9a:9f:b3:b6:91:1d:16:b9:d1:e0:cf:15:bd:a0:d9:d8:df:fd:51:be:d6:a5:30:f0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

x64bridge

msvcp120

msvcr120

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 660B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 112B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

0b:f5:2d:39:12:08:a7:81:9a:9f:b3:b6:91:1d:16:b9:d1:e0:cf:15:bd:a0:d9:d8:df:fd:51:be:d6:a5:30:f0
Signer

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 660B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 112B