Wexize[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Wexize.exe
Size 2.9MB
Sample260627-yre4vsds7v
SHA256 873e91ccff5ef1eddc20a2c000303a9e3dbe6732c1709b21c26decda6511f580
MD5 f48c8883916a80fbb3756a7d504e50a0
SHA1 20a2e5ad80caa06117e109421bdcf6565d2aa58e
SHA512 5aebaa3ebf027a364539994a2bc52f5a37e7cbc03f4105a85c053d1659d8d556a3a17430a2a78cfa480ca36d0663d2add29ece8bc267cfb6da106c5ff50695d1
SSDEEP 49152:LXFcaDMXQtVZot/EMeHXiemT8+HE7o/+uPEXapldp/5543Mi9fc:DFHPVatvAuP1pl3/554N
TLSH
T102E5CF43A3A501E9C527D03CC6479317E37278450720ABDB67E44B9A6FA3AE06BFE351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Wexize.exe

File Explorer

Wexize.exe

.exe 2.9MB

Wexize.exe

IMPHASH f6b66e7aeef7e744fb44b830a7c9aa3c
SHA256 873e91ccff5ef1eddc20a2c000303a9e3dbe6732c1709b21c26decda6511f580
MD5 f48c8883916a80fbb3756a7d504e50a0
SHA1 20a2e5ad80caa06117e109421bdcf6565d2aa58e
SHA512 5aebaa3ebf027a364539994a2bc52f5a37e7cbc03f4105a85c053d1659d8d556a3a17430a2a78cfa480ca36d0663d2add29ece8bc267cfb6da106c5ff50695d1
SSDEEP 49152:LXFcaDMXQtVZot/EMeHXiemT8+HE7o/+uPEXapldp/5543Mi9fc:DFHPVatvAuP1pl3/554N
TLSH
T102E5CF43A3A501E9C527D03CC6479317E37278450720ABDB67E44B9A6FA3AE06BFE351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1447480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mnjmk\Desktop\Wexize-V2\x64\Release\Wexize Revamp.pdb

d3dx9_43

D3DXVec3Normalize D3DXVec3Transform D3DXMatrixTranspose

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

CheckRemoteDebuggerPresent CreateRemoteThreadEx FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter WaitForMultipleObjects PeekNamedPipe QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW OpenThread GetTickCount64 GetStdHandle InitializeSListHead FreeLibrary GetEnvironmentVariableA VerSetConditionMask WaitForSingleObjectEx MoveFileExA GetProcAddress QueryPerformanceFrequency LoadLibraryA VerifyVersionInfoA GetLocaleInfoA WideCharToMultiByte GlobalFree GetSystemDirectoryA MultiByteToWideChar ExitProcess SleepEx DeleteCriticalSection InitializeCriticalSectionEx DuplicateHandle GetProcessId IsDebuggerPresent GetTickCount GetCurrentProcessId GetFileType CreateThread LeaveCriticalSection EnterCriticalSection CreateFileMappingA TerminateProcess VirtualAlloc VirtualProtect GetSystemTimeAsFileTime WriteProcessMemory GetLastError GetModuleHandleA GetCurrentProcess GlobalUnlock CreateRemoteThread GlobalLock Beep GlobalAlloc Sleep ReadProcessMemory VirtualProtectEx CloseHandle K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next MapViewOfFile VirtualFreeEx VirtualAllocEx HeapFree UnmapViewOfFile HeapAlloc ReadFile GetFileSizeEx CreateFileA SetUnhandledExceptionFilter SetLastError

user32

GetClipboardData SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard UpdateWindow FindWindowA PostQuitMessage GetWindowLongPtrA SetClipboardData GetForegroundWindow mouse_event PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow MessageBoxA ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW DestroyWindow GetWindowRect DispatchMessageA GetAsyncKeyState GetCursorPos GetWindowThreadProcessId SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState GetWindowTextLengthA SetWindowsHookA IsWindowVisible GetWindowTextA EnumWindows FindWindowW

advapi32

CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation OpenProcessToken AdjustTokenPrivileges QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService OpenServiceA CryptAcquireContextA RegGetValueA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xbad_function_call@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Query_perf_counter ?_Xbad_alloc@std@@YAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ _Query_perf_frequency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??7ios_base@std@@QEBA_NXZ

ws2_32

ntohs closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons setsockopt socket WSASetLastError WSAIoctl ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup

normaliz

IdnToAscii

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateChain CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore

wldap32

ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord26 ord22 ord41 ord50 ord143 ord60 ord211 ord46 ord217 ord45

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy __std_exception_destroy __std_exception_copy __std_terminate strstr strchr wcsstr strrchr longjmp

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode calloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm_e _initterm _c_exit exit _get_narrow_winmain_command_line terminate strerror _errno _beginthreadex _getpid _seh_filter_exe __sys_nerr _invalid_parameter_noinfo_noreturn _cexit _set_app_type _crt_atexit _exit _configure_narrow_argv _initialize_narrow_environment _register_onexit_function _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s strcmp strpbrk strcspn strspn isupper _strdup toupper strncpy tolower

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoll strtoull strtol atof mbstowcs strtoul

api-ms-win-crt-math-l1-1-0

fmodf pow powf sinf sqrt sqrtf cosf atan2f acosf _hypotf __setusermatherr _dsign ceilf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fputc _set_fmode _lseeki64 fflush fclose _open _close _write fgets fgetc _read feof fwrite fputs fopen fgetpos setvbuf ungetc __stdio_common_vsscanf _wfopen __stdio_common_vsprintf_s fsetpos __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 __p__commode fread

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _access _lock_file _unlink _stat64 _fstat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64