sunwukongs[.]exe | Triage™

General

Target
sunwukongs.exe
Size 1.1MB
Sample260424-2789esft2n
SHA256 711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685
MD5 1a130a9975c3f5ad8977a58fbfe06e18
SHA1 ec1875f605e5856ab101bfbdb4bdbb29733fc366
SHA512 e664ec1b7ff1b7977ee8fde2583cbcd64c6fe503b7419b55d9af39082703f49b56701be9f5b493bf335214feec2415573df9553cd59d570b74b364e5d49516c1
SSDEEP 24576:/CUYZcuL5nZWtds61LuD0Ax8M1Phrw5dJYP1T:/3YZcAItd1uHnP1T
TLSH
T1963548F850087458D0CAAB750740BB1DB474ACAD6BB00AB3DAB7FE65CB3EA83761D154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
sunwukongs.exe

File Explorer

sunwukongs.exe

.exe 1.1MB

sunwukongs.exe

SHA256 711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685
MD5 1a130a9975c3f5ad8977a58fbfe06e18
SHA1 ec1875f605e5856ab101bfbdb4bdbb29733fc366
SHA512 e664ec1b7ff1b7977ee8fde2583cbcd64c6fe503b7419b55d9af39082703f49b56701be9f5b493bf335214feec2415573df9553cd59d570b74b364e5d49516c1
SSDEEP 24576:/CUYZcuL5nZWtds61LuD0Ax8M1Phrw5dJYP1T:/3YZcAItd1uHnP1T
TLSH
T1963548F850087458D0CAAB750740BB1DB474ACAD6BB00AB3DAB7FE65CB3EA83761D154
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1e:c0:1d:20:23:7c:cc:5e:b9:ad:9f:8a:aa:78:78:e7:42:2d:4f:23:65:ff:d9:cb:cb:4c:ba:d8:e8:1d:cd:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

103312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AddonPackProvider AllocateValidator CheckStrategyNew CommonAdjustList ComputeDecoder ComputeProvider ConnectionAnalyzeValidator ConnectionSendAlgorithm ConverterHandler DecompressUnpacker DecompressorPacker DriveSendArray EncoderConvert ExtensionEnableFactory FileSignalScope HeapHandler HelperAcceptMemory InitializeDomain InspectToken InterpreterExecuteValidator ListCreator ManagerHandler ManagerProcessor NetworkSendChannel OptionProvider ParameterGenerator ParserDisconnect QueueGenerator QueueUpdateer ReceiveParameter ResumeObject ResumeSession ScopeCompute ScopeManager SerializerUninitializeStream TestText UnbindString UnpackValue ValidateHeap ValidatorDecodeConfig ValidatorFree ValueFormatter VerifyFormatterSync _AcceptControllerSlow@28 _AcceptToken@0 _AcquireArray@28 _AcquireToken@24 _AddonDecryptMemory@4 _AddonUnbindEnvironment@28 _AdjustMethod@8 _AllocateObject@4 _ArchiveAccept@12 _ArchiveCalculate@28 _ArchiveExecuteObject@20 _ArchiveGenerateer@24 _ArchiveProvider@4 _ArchiveValidate@20 _ArrayCreator@0 _ArrayHandler@4 _AudioDestroyProcessor@8 _AudioFormatManager@4 _AuthEncodeFormatter@20 _BaseHandleController@20 _BindText@24 _BufferAnalyzeObject@24 _BufferControlManager@20 _BufferGenerateDomain@24 _BufferHandler@12 _BufferInitializeer@0 _BufferManager@12 _BufferService@8 _BufferUnpackPolicy@0 _BuilderAdjustRecord@12 _BuilderProcessor@8 _BuilderProvider@24 _BuilderSendArray@4 _BusinessValidateHandler@12 _BusinessVerifyAlgorithm@12 _CacheEncryptChannel@4 _CalculateEncoderSafe@8 _CertificateCorrecter@20 _CertificateCreator@20 _CertificateProcessor@16 _ChangeFile@0 _ChannelFormatter@24 _ChannelHandler@24 _CheckArray@0 _CheckPacker@8 _CheckerConvertMemory@20 _CheckerGenerateIdentity@12 _CommonControlMemory@16 _ComponentAccepter@4 _ComponentBindFile@16 _ComponentClose@24 _ComponentInitializeArray@0 _ComponentService@28 _CompressFormatUnpacker@0 _CompressMeasureMemory@8 _CompressSetting@8 _CompressTestList@0 _CompressUpdateDecompressor@20 _CompressorHandler@0 _CompressorLoader@8 _CompressorParser@24 _ComputeChannel@16 _ConfigAccept@12 _ConfigBuilder@8 _ConnectContainerPublic@24 _ConnectDecoderV1@12 _ConnectFactoryV2@0 _ConnectionChangeOption@20 _ConnectionGenerator@8 _ConnectionManager@8 _ConnectionParser@12 _ContainerAllocator@12 _ContainerManageer@20 _ContextAllocator@8 _ContextHandler@4 _ContextReader@20 _ControlChannelV3@20 _ControllerAdjustConnection@8 _ControllerAllocator@16 _ControllerManager@4 _ControllerWriter@12 _ConvertConverter@0 _ConverterService@8 _CorrectArchiveV2@16 _CorrectContainer@16 _CorrectHeapEx@8 _CreatorDisconnectWriter@16 _CredentialAllocator@0 _CredentialEvaluateer@12 _CredentialLoad@24 _DataDisconnect@4 _DataProcesser@12 _DatabaseEncodeStrategy@8 _DatabaseLockInstance@20 _DecoderAcceptStack@0 _DecoderAllocator@24 _DecoderService@20 _DecompressLockDispatcher@12 _DecompressStackV1@12 _DecompressorLock@4 _DecryptMeasureField@24 _DecryptPackage@8 _DecryptorHandler@8 _DecryptorParser@4 _DecryptorProcessor@20 _DeserializerComputeScope@4 _DeserializerHashValue@28 _DeserializerSignalEndpoint@12 _DestroyComponent@20 _DestroyDecryptor@4 _DestroyEncoder@8 _DestroySchedulerSync@4 _DigestComputeCredential@0 _DigestDisconnectDomain@4 _DirectoryDisconnectCredential@12 _DirectoryFormatHeap@8 _DisconnectSessionV1@24 _DispatcherAcquireer@20 _DispatcherControl@0 _DispatcherCreator@12 _DispatcherEvaluateStrategy@20 _DispatcherHashConnection@4 _DrawListenSession@20 _DriveAnalyzeFormatter@16 _DrivePackReader@20 _EnableArchive@16 _EncodeDecoder@12 _EncodeString@12 _EncoderAllocateVerifier@8 _EncoderChangeValidator@12 _EncryptorDecompress@24 _EncryptorManager@12 _EncryptorProvider@0 _EndpointControl@8 _EndpointEvaluate@0 _EndpointProvider@20 _EntityManager@24 _EnvironmentHandler@12 _EnvironmentWriter@8 _EstimateCompressor@24 _EstimateEncryptor@20 _EstimateWriter@16 _EvaluateObject@20 _EvaluateSessionSafe@16 _EvaluateVerifier@0 _ExecuteBuffer@24 _ExecuteObject@20 _ExecuteParserPublic@12 _ExtensionCompressEnvironment@4 _ExtensionCreateCertificate@8 _ExtensionUnpackMemory@12 _FactoryAllocator@20 _FactoryConverter@8 _FactoryManager@16 _FactoryUnload@24 _FactoryUnlocker@4 _FieldDisable@12 _FieldManager@16 _FieldProvider@24 _FieldRead@0 _FileCompressArray@16 _FlagService@0 _FlagUpdate@24 _FlushArchiveVersion3@32 _FlushEncoder@12 _FormatComponentVersion3@4 _FormatterGenerator@4 _FormatterStopEnvironment@16 _FormatterUnbind@20 _FormatterWait@4 _FormatterWaitProcessor@8 _FreeRecord@20 _FreeSetting@16 _GenerateSchedulerV1@20 _GeneratorConnectModule@20 _GeneratorEvaluateWriter@24 _GeneratorPackParameter@12 _GeneratorTranslateMemory@20 _GraphicCorrectData@12 _GraphicDestroyFactory@24 _HandleEntity@24 _HandleOptionNew@4 _HandleTokenV1@28 _HandlerHandler@4 _HandlerManage@8 _HashList@16 _HeapAllocator@20 _HeapEnableProperty@24 _HeapGenerator@0 _HeapSignaler@0 _IdentityProvider@24 _ImageComputeQueue@4 _ImageStopOption@16 _InfoBuilder@12 _InfoManager@8 _InitializeBufferLegacy@4 _InitializeMemoryPrivate@24 _InstanceDisconnect@16 _InstanceManager@4 _InterpreterAdjustProcessor@28 _InterpreterDestroyHandler@16 _InterpreterUnbindProcessor@16 _JobConvertSession@20 _JobTransmitFile@4 _KeyAllocator@4 _KeyManager@16 _LockInfo@20 _LogLoadData@20 _LogMeasureOption@12 _LogSeekList@20 _LogSeekRule@16 _LogicProcessPackage@20 _LogicValidateHeap@20 _ManageConnection@24 _ManageQueueCurrent@24 _ManagerCreator@20 _ManagerManager@0 _MeasureStream@4 _MediaBuildController@8 _MediaChangeField@4 _MediaUnloadModule@16 _MediaValidateArchive@24 _MemoryAdjustValue@0 _MemoryCalculateStack@24 _MemoryDisable@24 _MemoryFreeer@20 _MemoryHandler@0 _MemoryParseProperty@0 _MemoryUnpacker@24 _MemoryWaitSetting@8 _MethodAllocateer@20 _MethodAllocator@0 _MethodBuilder@20 _MethodFormatter@0 _MethodUnpacker@28 _MethodWait@0 _ModifyInfoLegacy@8 _ModuleAllocator@0 _ModuleBind@24 _ModuleCreateBuilder@12 _ModuleGenerator@8 _ModuleHandleStack@12 _ModuleHandler@20 _MonitorProcessModule@4 _MonitorProcessReader@20 _NetworkConstructScope@16 _NetworkDecompressContext@16 _OptionFlushVerifier@8 _OptionMeasureValidator@4 _OptionService@4 _OptionValidateEncryptor@16 _PackCloseToken@8 _PackConnectAlgorithm@20 _PackCorrectComponent@24 _PackMemory@12 _PackerStart@4 _PackerUpdate@28 _ParameterBuilder@12 _ParameterParser@24 _ParseAlgorithm@24 _ParseTextExternal@20 _ParseValidator@20 _PauseRecordAsync@24 _PluginReceiveContainer@4 _PluginWaitScope@24 _PolicyCreator@20 _PolicyGenerator@8 _PreferenceHandleFactory@20 _PreferenceTranslateCertificate@20 _ProcessDecompressorOld@8 _ProcessInstance@24 _ProcessorConstruct@8 _ProcessorTranslateer@20 _ProfileCorrectToken@24 _ProfileProcessData@12 _PropertyBuilder@8 _PropertyVerifyer@24 _ProtocolPackQueue@12 _ProviderEstimateer@12 _ProviderProvider@8 _ProviderService@0 _ProviderUnbinder@12 _QueueAllocator@12 _QueueManage@12 _QueueReader@24 _QueueSignaler@4 _ReceiveChannelUnsafe@16 _ReceiveScheduler@0 _ReleaseDecompressor@16 _RenderHandleObject@4 _RightsCalculateOption@24 _SchedulerConnectReader@20 _ScopeHandler@0 _ScopeListener@20 _ScopeProvider@24 _SecurityFormatFormatter@8 _SerializerSendPolicy@28 _SerializerUnloadString@4 _ServiceAcquireController@16 _ServiceReleaseSession@4 _SessionBuilder@20 _SessionGenerator@12 _SessionHandler@20 _SessionLoader@4 _SessionReader@16 _SessionService@12 _SessionWrite@4 _SignalSettingFast@4 _SocketAcceptString@0 _SocketFormatManager@16 _SocketListener@4 _SoundInspectManager@4 _SoundUnbindUnpacker@4 _StackComputeDecoder@0 _StackCreator@4 _StackRegisterer@12 _StackSeekMethod@20 _StackTransmiter@4 _StartList@16 _StartValueV2@12 _StorageCorrectParser@4 _StrategyCalculate@8 _StreamBuilder@20 _StreamFormatWriter@20 _StreamReader@12 _StringHandler@20 _StringWriter@12 _SupportCheckMethod@20 _TaskConvertQueue@12 _TestStream@24 _TextCreator@4 _TextFlush@16 _TextHandler@8 _ThreadAdjustManager@24 _TokenHandler@20 _TokenStop@24 _TraceBindHeap@24 _TraceConvertValue@20 _TraceHashKey@28 _TraceModifyStack@16 _TransformerCheckDecoder@24 _TransformerConvertPackage@8 _TransformerManageEntity@16 _TransformerSeekChannel@0 _TranslatorConvertDispatcher@4 _TranslatorDisableEnvironment@0 _UnbindConverter@4 _UnloadComponentV4@20 _UnlockDomain@16 _UnlockStackEx@4 _UnpackDecodeText@20 _UnpackModule@4 _UnpackToken@4 _UnpackerInspecter@0 _UnpackerManager@28 _UnregisterStreamVersion2@0 _UpdateSocket@24 _UtilityValidateRecord@12 _ValidateStrategy@12 _ValidateTokenVersion3@0 _ValidatorAcceptVerifier@20 _ValidatorBuildHandler@4 _ValidatorDestroySession@12 _ValidatorFlushEnvironment@8 _ValidatorParser@16 _ValidatorProvider@28 _ValidatorTransformer@16 _VerifierLockPackage@16 _VerifyDecoder@8 _VerifyStringNonBlocking@8 _VideoCalculateValue@8 _VideoCreateEncoder@12 _VideoDisconnectEncoder@8 _VideoUnpackCertificate@8 _VideoUnpackValidator@24 _VolumeEvaluateVerifier@20 _VolumeReadStack@12 _VolumeUnlockInstance@12 _WorkFreeObject@12 _WorkModifyAlgorithm@12

Name

.text

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

631KB

Virtual Size

630KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

333KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sunwukongs.exe

PE Signature issue

generic