wwr[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wwr.exe
Size 9.5MB
Sample260729-ycrjca1dlf
SHA256 1749f1b032d3e2be6b9c81224822295d8b2009d76c1ad739b3cfd8cd167b7114
MD5 a6cdfdd40511638f7a0b37029c4e3daa
SHA1 47818b44833001750be89f40c095652870a654a3
SHA512 d577cab1182797a1e3ae089b3148a1daa411a3833ddb8f9f54da8c63f8c14b92856b2675b21d985e46d5e55953dcf66bb7b6a9593485978ed928886a0cc97eb7
SSDEEP 196608:/31+K84ZfvA1VhaPqfQ0ZUa9c1GlwNd+Y8KHc7Wh8OXg:/31+K84ZfvA1zaPcQ0jK8aAXy
TLSH
T131A60246B2A500F8D577913CCA679717E771740503309BEB23D84AA92F73BE06BBAB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wwr.exe

File Explorer

wwr.exe

.exe 9.5MB

wwr.exe

IMPHASH 8242f0e5698763900b69fc1c20770277
SHA256 1749f1b032d3e2be6b9c81224822295d8b2009d76c1ad739b3cfd8cd167b7114
MD5 a6cdfdd40511638f7a0b37029c4e3daa
SHA1 47818b44833001750be89f40c095652870a654a3
SHA512 d577cab1182797a1e3ae089b3148a1daa411a3833ddb8f9f54da8c63f8c14b92856b2675b21d985e46d5e55953dcf66bb7b6a9593485978ed928886a0cc97eb7
SSDEEP 196608:/31+K84ZfvA1VhaPqfQ0ZUa9c1GlwNd+Y8KHc7Wh8OXg:/31+K84ZfvA1zaPcQ0jK8aAXy
TLSH
T131A60246B2A500F8D577913CCA679717E771740503309BEB23D84AA92F73BE06BBAB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1218304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

CreateDirectoryW FindClose FindFirstFileW SleepEx GetSystemDirectoryW GetFileAttributesW GetFileAttributesExW LocalFree GetFileInformationByHandle LeaveCriticalSection GetTempPathW AreFileApisANSI EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive CopyFileW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType WaitForSingleObjectEx MoveFileExW GetTickCount SetDllDirectoryW ReleaseSRWLockExclusive FormatMessageW WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext SetLastError RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId DeleteCriticalSection GetSystemTimeAsFileTime InitializeSListHead InitializeCriticalSectionEx OutputDebugStringW CreateFileA GetFileSizeEx HeapAlloc VirtualFreeEx HeapFree K32EnumProcessModules CreateRemoteThread VirtualAllocEx Process32FirstW Process32NextW GetLastError GetTempPathA GetExitCodeThread CreateToolhelp32Snapshot GetEnvironmentVariableA CreatePipe K32GetModuleFileNameExW GetModuleFileNameW GetStdHandle WriteProcessMemory ReadFile CreateProcessA GetModuleHandleW GetCurrentProcessId ExitProcess CloseHandle Sleep MapViewOfFile UnmapViewOfFile OpenProcess WaitForSingleObject TerminateProcess GetCurrentProcess GetModuleFileNameA LoadLibraryW QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree CreateFileMappingA GetCurrentDirectoryW GlobalAlloc MultiByteToWideChar CreateFileW

user32

GetForegroundWindow GetWindowTextW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetWindowRect ShowWindow MoveWindow GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetWindowLongW TrackMouseEvent ClientToScreen GetCapture ScreenToClient

advapi32

CheckTokenMembership FreeSid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegQueryValueExA RegOpenKeyExA AllocateAndInitializeSid

shell32

SHGetKnownFolderPath SHGetFolderPathA ShellExecuteA ShellExecuteExA

ole32

CoTaskMemFree

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??Bios_base@std@@QEBA_NXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertCreateCertificateChainEngine

ws2_32

closesocket recvfrom sendto getaddrinfo freeaddrinfo getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen gethostname ioctlsocket

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception wcschr strchr _CxxThrowException memcmp memchr memset memmove memcpy __std_terminate longjmp strstr __std_exception_copy __std_exception_destroy wcsstr strrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf feof fputs __stdio_common_vfprintf _read _write _fileno fputc _close fseek fputwc ftell ungetwc fgets fclose fgetc _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _set_fmode _lseeki64 fgetwc fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp _strdup wcsncpy strncpy_s strncpy _wcsicmp towlower strpbrk strncmp strcspn wcspbrk strspn wcsncmp strcpy_s

api-ms-win-crt-heap-l1-1-0

calloc free realloc _set_new_mode malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

abort _errno _beginthreadex __sys_errlist __sys_nerr exit _invalid_parameter_noinfo_noreturn terminate _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

atoi strtoll strtoul strtol wcstombs

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen sqrtf acosf ceilf fmodf powf sinf cosf

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _unlock_file _wstat64 _fstat64

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func