Wolftaym[.]exe | Triage™

General

Target
Wolftaym.exe
Size 111KB
Sample260628-v4dvsaav4v
SHA256 a2c901469929aee016e5a953a5a7de552797d8701589b6580fe1a860f9b1bbd1
MD5 2690727c48f896cd7949cec043d1b07c
SHA1 b60caa1eb071b9a03884707ebd76e768c63e4260
SHA512 fd0fc6135c392a0043329a5e43eb23f7c971a6f00f0033603662d1640b1ad60f146d891629156e368fd62bf01cb9d2a2974e14d26c017bb57c1bce5d00d700bb
SSDEEP 3072:S7QQUF/1XVI3kEALLSSWovLbxwvjVQyCulsxagz7p:oQQwPFvLNrLS7XI
TLSH
T17DB35B0135D1C570E6A605352860DFB18B7DFE704FA19EEB73840B7A4E742C26A39E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Wolftaym.exe

File Explorer

Wolftaym.exe

.exe 111KB

Wolftaym.exe

IMPHASH 53c15af7def7ea92995c242e97a7ac8c
SHA256 a2c901469929aee016e5a953a5a7de552797d8701589b6580fe1a860f9b1bbd1
MD5 2690727c48f896cd7949cec043d1b07c
SHA1 b60caa1eb071b9a03884707ebd76e768c63e4260
SHA512 fd0fc6135c392a0043329a5e43eb23f7c971a6f00f0033603662d1640b1ad60f146d891629156e368fd62bf01cb9d2a2974e14d26c017bb57c1bce5d00d700bb
SSDEEP 3072:S7QQUF/1XVI3kEALLSSWovLbxwvjVQyCulsxagz7p:oQQwPFvLNrLS7XI
TLSH
T17DB35B0135D1C570E6A605352860DFB18B7DFE704FA19EEB73840B7A4E742C26A39E6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpOpen

user32

GetMessageW IsDialogMessageW LoadCursorA GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect UpdateWindow EnableWindow SetFocus ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage

gdi32

DeleteObject CreateSolidBrush CreateFontW SetBkColor

kernel32

GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW VirtualProtect GetConsoleMode FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW CreateFileW WriteConsoleW InitializeCriticalSectionEx GetLastError CreateFileA GetFileAttributesA GetFileSize GetFileSizeEx ReadFile SetFilePointerEx WriteFile CloseHandle CreateProcessA GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileType RaiseException RtlUnwind DecodePointer SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

Sharing