Static task
static1
Behavioral task
behavioral1
Sample
2025-02-27_f7ecddf6c68fa682bec8a847421c519b_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-02-27_f7ecddf6c68fa682bec8a847421c519b_smoke-loader_wapomi
-
Size
94KB
-
MD5
f7ecddf6c68fa682bec8a847421c519b
-
SHA1
0f5bd33ae134db2ac9efb4b36ff84850cb22d013
-
SHA256
caefd53d1368a9e80e4cb0b15b4f803b8bea5a722c3001bf3778cc9dff7906b8
-
SHA512
a34323ede0d921314c5c8699f95d2b1212d6d94215ec141a4ae7e1a39d0fe430b9323f79682c5d4bc5d66097e8b43aa9ba8d3459c9a3fab8c88c52ac8b5e0eac
-
SSDEEP
1536:3HSpeffJzpa4PKvvMupbRzh7mI565HrVTblQfqAYUGCq2iW7z:3HSpefhpa4PKHffw9hTSf1GCH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-02-27_f7ecddf6c68fa682bec8a847421c519b_smoke-loader_wapomi
Files
-
2025-02-27_f7ecddf6c68fa682bec8a847421c519b_smoke-loader_wapomi.exe windows:5 windows x86 arch:x86
01dd93f996c09615db1474b28d83a9ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
authz
AuthzFreeContext
AuthzAddSidsToContext
AuthzFreeAuditEvent
AuthzFreeResourceManager
AuthzInitializeContextFromSid
wtsapi32
WTSFreeMemory
WTSVirtualChannelPurgeInput
WTSEnumerateServersA
WTSEnumerateProcessesA
WTSEnumerateSessionsW
kernel32
WriteProcessMemory
OpenEventA
MoveFileA
GetFileAttributesW
DecodePointer
InterlockedIncrement
GetACP
CreateEventA
GetModuleHandleA
OpenFileMappingA
GetEnvironmentVariableA
VirtualAlloc
GetEnvironmentVariableW
LoadLibraryExW
user32
LoadBitmapW
IsCharLowerA
MessageBoxExW
GetMessageA
MessageBoxW
CreateWindowExW
SetWindowTextW
GetWindow
InsertMenuW
FindWindowW
FindWindowW
GetFocus
shell32
ExtractIconW
DragQueryFileA
ShellMessageBoxA
ShellExecuteW
DragQueryPoint
FindExecutableW
SHEmptyRecycleBinW
FindExecutableW
SHDefExtractIconW
ShellAboutA
SHGetFileInfoA
SHGetDataFromIDListW
resutils
ClusWorkerTerminate
ResUtilDupString
certcli
CAEnumNextCA
CACloseCertType
advapi32
RegSaveKeyW
RegReplaceKeyA
IsValidSid
RegDeleteValueW
CryptSignHashA
ReadEventLogW
RegCreateKeyExW
RegUnLoadKeyA
IsValidAcl
InitializeAcl
OpenEventLogA
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwer Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Lus�u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE