WizardExternal_new_verify[.]exe

Resubmissions

10/07/2026, 00:14

260710-ajt12sct9y

10/07/2026, 00:14

260710-ajpfkact7z

09/07/2026, 23:44

260709-3q6bwaay6q3

Sharing

Copy URL Twitter E-mail

General

Target
WizardExternal_new_verify.exe
Size 6.0MB
Sample260710-ajpfkact7z
SHA256 6b415b355c15ed75e9763a609ef56e484b32d17032b0891cd9158f158a9a2b81
MD5 377d00423054f0afe51f5f932e69ad04
SHA1 12b5a1b6459d1a21d8fe9d200d6596ea604c0ebe
SHA512 ac3265e7fc3fc63880a702679de59acc0ead351872f29e37d3fdbd134514ae296d8175f17b0749ba65955576d171df6a3985aed8d91daebcc1e031dfcebe08fb
SSDEEP 98304:TJaUkUTpdgVgpFEqA2YUiEZdmIdUwpeplT6BRdFP3Onf5:Tr6CFXA2tiEZ/dGTaRenh
TLSH
T16056D047B39A57EDC13664384F42E213EFE2B400073AA2DBF7A189199A172F40D7DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WizardExternal_new_verify.exe

File Explorer

WizardExternal_new_verify.exe

.exe 6.0MB

WizardExternal_new_verify.exe

IMPHASH 4d357bfe9f938c88b83a584f67a003e3
SHA256 6b415b355c15ed75e9763a609ef56e484b32d17032b0891cd9158f158a9a2b81
MD5 377d00423054f0afe51f5f932e69ad04
SHA1 12b5a1b6459d1a21d8fe9d200d6596ea604c0ebe
SHA512 ac3265e7fc3fc63880a702679de59acc0ead351872f29e37d3fdbd134514ae296d8175f17b0749ba65955576d171df6a3985aed8d91daebcc1e031dfcebe08fb
SSDEEP 98304:TJaUkUTpdgVgpFEqA2YUiEZdmIdUwpeplT6BRdFP3Onf5:Tr6CFXA2tiEZ/dGTaRenh
TLSH
T16056D047B39A57EDC13664384F42E213EFE2B400073AA2DBF7A189199A172F40D7DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1564080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter Sleep TerminateProcess SetErrorMode GetCurrentProcessId GetTickCount SetUnhandledExceptionFilter GetSystemInfo CreateProcessW QueryFullProcessImageNameW GetSystemTimeAsFileTime GetProcessTimes Process32NextW GlobalFree GetModuleHandleW GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA WakeAllConditionVariable GetStartupInfoW InitializeSListHead GetLastError MultiByteToWideChar GlobalLock GlobalAlloc ExitProcess K32GetModuleFileNameExA GetExitCodeThread CreateToolhelp32Snapshot OpenProcess GetModuleHandleA Module32First WaitForSingleObject GetProcessId Module32Next WriteProcessMemory Process32First VirtualFreeEx VirtualAllocEx WideCharToMultiByte FlushInstructionCache GetVolumeInformationW Module32NextW FreeLibrary ReadProcessMemory GetProcAddress VirtualProtectEx Module32FirstW LoadLibraryW CloseHandle Process32FirstW GetCurrentProcess GetTickCount64 Process32Next

user32

GetForegroundWindow TranslateMessage GetClientRect SetFocus GetKeyNameTextA MapVirtualKeyA MessageBoxA PeekMessageA GetSystemMetrics GetWindowLongA LoadIconA GetWindowThreadProcessId SetLayeredWindowAttributes CreateWindowExA DefWindowProcA RegisterClassA EnumDisplaySettingsA GetMonitorInfoA ClientToScreen SetWindowLongA ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW EnumDisplayMonitors SetActiveWindow MonitorFromWindow SetWindowPos GetDC DestroyWindow GetWindowRect DispatchMessageA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseCapture IsWindowUnicode FindWindowA SetCursor SetCapture UpdateWindow SetForegroundWindow IsIconic SetCursorPos ReleaseDC PostQuitMessage BeginPaint EndPaint IsWindow SetWindowDisplayAffinity mouse_event GetAsyncKeyState

gdi32

BitBlt CreateCompatibleBitmap SelectObject StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateCompatibleDC

advapi32

RegCreateKeyExW RegQueryValueExW AdjustTokenPrivileges OpenProcessToken GetTokenInformation RegCloseKey RegSetValueExW RegDeleteTreeW RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z __crtLCMapStringA __crtLCMapStringW ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_detach _Thrd_join ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Wcscoll ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Incref@facet@locale@std@@UEAAXXZ

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

wininet

InternetReadFile InternetOpenA InternetOpenUrlA InternetCloseHandle

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __intrinsic_setjmp __current_exception_context __current_exception strstr memcmp memchr memset __RTtypeid strchr memmove __std_type_info_compare __std_terminate memcpy __std_exception_copy __std_exception_destroy longjmp strrchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc realloc _callnewh free

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy isdigit _stricmp _wcsicmp isspace tolower toupper strlen wcslen

api-ms-win-crt-math-l1-1-0

pow atan2f _hypotf powf fmodf floorf expf cosf ceilf _dsign __setusermatherr roundf sqrtf sinf sqrt acosf

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtoull strtoll mbstowcs strtod

api-ms-win-crt-runtime-l1-1-0

_errno _c_exit _exit terminate _beginthreadex exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit _configure_narrow_argv _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-time-l1-1-0

_time64 _mktime64 _localtime64_s

api-ms-win-crt-stdio-l1-1-0

fputc fgetc fwrite fflush fsetpos fread __stdio_common_vsprintf fgetpos ungetc _fseeki64 _get_stream_buffer_pointers setvbuf _set_fmode ftell __p__commode __stdio_common_vsscanf _wfopen __stdio_common_vfprintf fseek fclose __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_locale_name_func ___lc_collate_cp_func _configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_wgetenv