General
-
Target
windwm.txt.exe
-
Size
63KB
-
MD5
ba7183605e3cff27ae2223a4459c90e7
-
SHA1
8916ea30fa63768e0f3e53fc5b41f97fdd9d0377
-
SHA256
125b204f8b8f0767d5246746e4788602a7fd521f673a779579a0e5d20a9030a0
-
SHA512
ae4f4df7eae53afba2573c098205246ee28207ac4299e4449bb4e6e2a48a7fbc37939fe358e2c05a7b454c98128466dbd4bdf524abeb9644c0b0279dc2945457
-
SSDEEP
1536:/2wukvF1ak9gcKu5UYFyiONqm5bOAPBqOmvJrPlTGxx:/2dkvF1ak9Ku5UYFyBx5bOCqOmvJdKx
Malware Config
Extracted
asyncrat
| nelsontriana980
Default
subwoope.ooguy.com:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
windwm.txt.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ