WeChat[.]exe | Triage™

General

Target
WeChat.exe
Size 2.8MB
Sample250824-laf9datmx9
SHA256 f26500ee852cdb8e17853efc48c3cfb5b08bebdbe2a37bc5a9009ab1b854d64b
MD5 25f774cf317041e4f5bf5660a696b4a6
SHA1 a22247deabea3e94db9787cad5c80986b5f1ea7d
SHA512 2f3801f281ebc63fc5abb92447811f0c650daefac941c147af17e4ed3c3ee3f9f43da449e87ad5dfc784641418d33026c5e7f4a5fd7ece234dc6c4de009e4a5e
SSDEEP 49152:hvP2Yd+bgkAspLXbHl/KImpQklhpPjeWuhyHwC6OkzeQW4ZqvuqP+Ia:9ePPVCb5F6rhyQPAvuqP+Ia
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
WeChat.exe
unpack001/out.upx

File Explorer

WeChat.exe

.exe 2.8MB
out.upx

.exe 6.3MB

WeChat.exe

SHA256 f26500ee852cdb8e17853efc48c3cfb5b08bebdbe2a37bc5a9009ab1b854d64b
MD5 25f774cf317041e4f5bf5660a696b4a6
SHA1 a22247deabea3e94db9787cad5c80986b5f1ea7d
SHA512 2f3801f281ebc63fc5abb92447811f0c650daefac941c147af17e4ed3c3ee3f9f43da449e87ad5dfc784641418d33026c5e7f4a5fd7ece234dc6c4de009e4a5e
SSDEEP 49152:hvP2Yd+bgkAspLXbHl/KImpQklhpPjeWuhyHwC6OkzeQW4ZqvuqP+Ia:9ePPVCb5F6rhyQPAvuqP+Ia
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

6915312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 06dd877d21ee66d6e870b044ce36706e21a6f1572993fe5ff5bc2d39f95a4641
MD5 4c7197fd795665d6934a7e274221ef76
SHA1 fee1242ecc5aea8c2be7b6e5282609249ce48d6a
SHA512 eeff9d5af2c1095a444ccace7bce7f7d3d743ce668d19eba1d242eee833cc96cb11f11624fd1c25b48848c8fd8c80306be627343f3757b13b7c2e91f913cd937
SSDEEP 49152:9g0rfySIagHGUYpcvcWkZ3RrjuxMDd8afEMOZZcWj9qo4I1yL/XoVwW+dCfg5E:ZrfySIVGvpEcNqxgXbWJfSE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

491120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

281KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

413KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WeChat.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

WeChat.exe

generic

out.upx

generic