wlanwin[.]exe | Triage

Sharing

General

Target

wlanwin.exe
Size

92KB
MD5

3e11228f187c0f0a7a9bb7a3beae8e89
SHA1

6c218b3c8528e1a473e3519f042f1c60a188304b
SHA256

3190f80b95d0a2679d8477b8ee7593e3b92e98d4ce95a6b328d42a61c60fe0c9
SHA512

dc51f586260184c6f310c52ce38ac4385353c723878c7b25aab5b8dad978b4c1cb21630bff214ebd94fd3d9ed7772c814d64802dc9b520e4bd9283138fc371e2
SSDEEP

1536:ZZ50d92KsGOVln83oXWX1tZVJbnNeP3ZCjdJNNaXufs:Z/JK3OIYGrZVJLcP3ZidDcas

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wlanwin.exe

Files

wlanwin.exe
.exe windows:5 windows x86 arch:x86

4d265499c4509f041b4c773408a647c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadConsoleInputA
InterlockedIncrement
VirtualQuery
IsProcessInJob
GetVersionExW
LocalFree
DefineDosDeviceA
IsSystemResumeAutomatic
UnhandledExceptionFilter
GetUserDefaultLCID

advapi32

RegQueryValueExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
IsValidSecurityDescriptor

secur32

AcquireCredentialsHandleA

user32

EmptyClipboard
CallWindowProcW
GetActiveWindow
InSendMessage

gdi32

CreateFontA
AddFontResourceW
CreateHatchBrush
CreatePen

winscard

SCardLocateCardsW

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ