wtf[.]scr | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wtf.scr
Size 676.4MB
Sample250309-dsymdaxvbz
SHA256 e18d055fc0faaa16b5b860e1995f2cd701a89c1d7b3e2ed7c9efe5f96977e266
MD5 6f8b3f0fb8a6ef77e799b09bc97e9803
SHA1 2d8dde0b641755ff5641d5ed3a102182813b15f7
SHA512 e9ff548e483a41f6f2a49ea574a21075f3266b8e3c950e263ce2b64ce988cd9a603e41898f6b46987e338e693da7e890b13c2663eff097df8207f7bb3afdc210
SSDEEP 49152:OobxvbkfN8ObOQzhSSsOfADj58RFxDEF4B6iiw/G:hdvgN8yaDqRFxDbSr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wtf.scr

File Explorer

wtf.scr

.exe 676.4MB

wtf.scr

IMPHASH 28bc2fbb72dee9bd9a85f2253aa54301
SHA256 e18d055fc0faaa16b5b860e1995f2cd701a89c1d7b3e2ed7c9efe5f96977e266
MD5 6f8b3f0fb8a6ef77e799b09bc97e9803
SHA1 2d8dde0b641755ff5641d5ed3a102182813b15f7
SHA512 e9ff548e483a41f6f2a49ea574a21075f3266b8e3c950e263ce2b64ce988cd9a603e41898f6b46987e338e693da7e890b13c2663eff097df8207f7bb3afdc210
SSDEEP 49152:OobxvbkfN8ObOQzhSSsOfADj58RFxDEF4B6iiw/G:hdvgN8yaDqRFxDbSr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2042704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP LocalFree CloseHandle SizeofResource GetCurrentProcessId QueryPerformanceFrequency IsDebuggerPresent VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority SetThreadPriority GlobalLock GetCurrentProcess VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

shell32

Shell_NotifyIconW SHAppBarMessage ShellExecuteW

ole32

IsEqualGUID OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CopyImage CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx PeekMessageW MonitorFromWindow GetDlgCtrlID GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW CreateAcceleratorTableW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW ShowOwnedPopups GetSystemMenu GetScrollRange GetScrollPos SetScrollPos GetActiveWindow SetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW DrawFocusRect EnumChildWindows GetScrollBarInfo ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics SetWindowLongW PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild ClientToScreen GetClipboardData SetClipboardData SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetClassLongW ActivateKeyboardLayout GetParent DrawTextW SetScrollRange MonitorFromRect InsertMenuItemW PeekMessageA GetPropW SetClassLongW MessageBoxW MessageBeep SetPropW RemovePropW UpdateWindow GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW EmptyClipboard IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowPos SetWindowRgn GetMenuItemCount RemoveMenu GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage OpenClipboard DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu CopyIcon DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint ValidateRect SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowLongW GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement CreateIconIndirect FindWindowW DeleteMenu GetKeyboardLayout

oleaut32

SysFreeString VariantClear VariantInit GetErrorInfo SysReAllocStringLen SafeArrayCreate SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc SetAbortProc SetTextColor StretchBlt RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette PolyBezierTo CreateICW CreateDCW GetStockObject CreateSolidBrush Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW GetSystemPaletteEntries GetEnhMetaFileBits AbortDoc GetEnhMetaFilePaletteEntries CreatePenIndirect CreateFontIndirectW PolyBezier EndDoc GetObjectW GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC FrameRgn BitBlt GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap SetWinMetaFileBits GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

158B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

84B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

��8

Size

674.0MB

Virtual Size

674.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wtf.scr

kernel32

winspool.drv

shell32

ole32

version

user32

oleaut32

advapi32

gdi32

generic