E:\w\328b3cc762394cc5\sw\physx\PhysXSDK\2.8.3\RELEASE\bin\win64\PhysXCooking64.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
launcher.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
launcher.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
witwin_st_x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
witwin_st_x64.dll
Resource
win10v2004-20240802-en
General
-
Target
21092024_0101_witwin_st_x64.zip
-
Size
455KB
-
MD5
34117ab2482ef34229eaf6d00da00fae
-
SHA1
2bfee6b21b94d41d69fdf0d6e41ab0e3399c6b81
-
SHA256
b4a933b088f2b17533a0b0263ec57dce29b0f221517bbb2df740db387db5579a
-
SHA512
783f22c415fd59553257bfdba421e8b97b07a717cdd1c576abeba8bebb1e0bdb8ccabdd6054ed08415f6a92ab000e4eef8bdd8fa8ba6ae78b9e76112aaabdb83
-
SSDEEP
12288:/eW3vlQRTqlKsLkLhKZ+eWclBDjC14U9pMkMZuX2:/eavsT+5gLhJevvC39p3ME2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/witwin_st_x64.dll
Files
-
21092024_0101_witwin_st_x64.zip.zip
Password: infected
-
launcher.bat
-
witwin_st_x64.dll.dll windows:5 windows x64 arch:x64
Password: infected
fc95d9602c39b01774b1f9a2b19b1e87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
CloseHandle
Sleep
QueryPerformanceCounter
CreateFileW
GetProcessHeap
SetEndOfFile
GetStringTypeW
LCMapStringW
WriteConsoleW
CreateFileA
FlushFileBuffers
SetStdHandle
RtlPcToFileHeader
HeapAlloc
GetLastError
HeapFree
HeapReAlloc
DecodePointer
EncodePointer
FlsSetValue
GetCommandLineA
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
HeapSize
RtlUnwindEx
FlsGetValue
FlsFree
SetLastError
FlsAlloc
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RaiseException
wsock32
send
WSAGetLastError
recv
htons
gethostbyname
ioctlsocket
gethostbyaddr
socket
connect
closesocket
inet_ntoa
WSAStartup
Exports
Exports
NxCloseCooking
NxCookClothMesh
NxCookConvexMesh
NxCookSoftBodyMesh
NxCookTriangleMesh
NxCreatePMap
NxGetCookingInterface
NxGetCookingParams
NxInitCooking
NxPlatformMismatch
NxReleasePMap
NxReportCooking
NxScaleCookedConvexMesh
clBuildProgram
Sections
.text Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ