sunwukongs[.]exe | Triage™

General

Target
sunwukongs.exe
Size 1.4MB
Sample260429-vdlspsdx81
SHA256 8bbd5525d11b0aeecd5d9bc385c080cf2fd1b4a6aba76caf62b16426a0840ba2
MD5 875e998ef2d45fb492546fd751262655
SHA1 32a7bb88504af80a2b1cc5852fd489475ef83c72
SHA512 cd349cb452c246c1e03b7d43f6fedb0f9da70313cad4e605fbcd41b65f0a21de082c81391d1428505de8c65a6954b5177ceaad2a28876676d6f30580ce13a95f
SSDEEP 24576:J40t7jW1PUaekYF0Va8lTnoRDcqR9YxHs4pW24tNKJGyO:t7uUV4VtT0gdxHsUaNZ
TLSH
T1F3653BEF676069C8D8D16AFC94B76D0157A0BCB379D2409E1982EF1BCD28913CE38275
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
sunwukongs.exe

File Explorer

sunwukongs.exe

.exe 1.4MB

sunwukongs.exe

SHA256 8bbd5525d11b0aeecd5d9bc385c080cf2fd1b4a6aba76caf62b16426a0840ba2
MD5 875e998ef2d45fb492546fd751262655
SHA1 32a7bb88504af80a2b1cc5852fd489475ef83c72
SHA512 cd349cb452c246c1e03b7d43f6fedb0f9da70313cad4e605fbcd41b65f0a21de082c81391d1428505de8c65a6954b5177ceaad2a28876676d6f30580ce13a95f
SSDEEP 24576:J40t7jW1PUaekYF0Va8lTnoRDcqR9YxHs4pW24tNKJGyO:t7uUV4VtT0gdxHsUaNZ
TLSH
T1F3653BEF676069C8D8D16AFC94B76D0157A0BCB379D2409E1982EF1BCD28913CE38275
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

da:35:2b:60:5e:bd:e5:ea:36:47:19:8d:1f:1c:b4:2a:5c:f3:e3:88:b7:83:ce:f5:86:37:9f:aa:f5:45:ef:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

165872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AcquireProviderUnsafe AddonBuildToken AddonDecodeParameter AlgorithmBuilder AlgorithmUnlock AllocProcessObject ArchiveBuilder BaseStopEncoder BufferDisableSession BufferGenerator BuildToken BuilderCompressBuilder BuilderCompressMethod BusinessCalculateSession BusinessStartComponent CacheTestObject CalculateHandler CalculateQueue CertificateCreator CertificateProvider ChangeSession ChannelProvider CheckController CheckIdentity ComponentAllocateer ComponentTransmitHandler CompressCompressField CompressInfoPrivate CompressInstance CompressStack CompressorAllocator CompressorBuilder ComputeQueue ConfigProcessConverter ConfigResumeer ConnectEndpoint ConstructHandler ConstructStrategySafe ContextFormatter ContextManager ControllerMeasureer ControllerResume ConvertObjectEx ConverterAnalyze ConverterReleaseer ConverterWriter CorrectBuilder CorrectToken CreatorGenerateSession CredentialManager CryptoCalculateParameter DataService DecodeDispatcher DecodeFactory DecoderAllocator DecompressStringFast DecompressorWriter DecryptorAllocator DecryptorCreator DecryptorService DestroyComponent DestroyConnection DigestDecompressDomain DigestEnableFormatter DisconnectDecryptorCurrent DomainAllocate DriveConvertCompressor DriveValidateCredential EnableChannel EnableRecord EnableStrategy EncoderEvaluate EncoderTestConverter EncryptorCreator EncryptorManager EncryptorProvider EndpointProcessor EntityAdjuster EntityBuilder EntityProvider EntityService EvaluateArchive EvaluateMemory EvaluateOptionBlocking EvaluateScope ExecuteCredential FactoryManageConfig FactoryManager FieldManager FileUnbind FlagReader FlushArchive FormatAlgorithm FormatFormatter FormatterProvider FormatterService FreeStartDecryptor GenerateScope HandlerCreator HeapManager ImageReadPacker InfoPauseer InstanceOpener InterpreterModifyEntity InterpreterStopProvider KeyCreator KeyManage ListChecker ListCreator ListenProvider ListenStrategy ManageProviderNonBlocking MapperConstructString MapperReadToken MapperUnregisterIdentity MeasureEntity MediaConnectSession ModifyDecryptor ModifyQueue ModuleAllocator ModuleService NetworkConvertOption NetworkUninitializeReader ObjectProvider OptionBuilder OptionDecompress OptionHandler OptionWriteer PackUpdateFlag PackageDecompresser PackerCompress ParameterHandler ParserBuilder PathCalculateFlag PauseProperty PluginStartDecoder PolicyProvider PreferenceAcceptScheduler ProcessParser ProcessorAcquire PropertyParser ProtocolTestValue ProviderFlush ProviderFreeer ProviderHandler QueueCalculate QueueProvider QueueWriter ReceiveText ReleaseEncryptor ResumePackerCurrent SchedulerDecryptValidator SecuritySignalProperty SeekSessionSlow ServiceEnableString SessionCompute SessionExecute SessionProvider SessionWriteer SoundReceiveArchive StackCompresser StackHandle StackTranslateParser StartPacker StartValue StorageCreateObject StorageMeasureCertificate StrategyStoper StreamWriteer TaskBindManager TestString TesterAcquireMemory TesterCloseInfo ThreadEnableSocket ThreadProcessPolicy ThreadRegisterScheduler TraceProcessParser TraceWriteArchive TransformEncryptor TranslateScheduler TranslatorUnbindConnection TransmitSetting UnlockIdentity UnlockOptionNew UnpackController UnpackEncoder UnpackerAllocateer UnpackerReader UpdateConverter UpdateUnpacker ValidateBuffer ValidatePackerVersion3 ValidatorBuilder ValidatorComputeInfo ValidatorCreator ValidatorFormatScope ValidatorGenerator ValueVerifyer VerifierCalculateChannel VerifierSender VideoComputeToken VideoReceiveOption VolumeEncodeModule VolumeFlushWriter WorkComputeReader

Name

.text

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1011KB

Virtual Size

1010KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sunwukongs.exe

PE Signature issue

generic