be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a

Sharing

Copy URL Twitter E-mail

General

Target
be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a
Size 625KB
Sample260802-wsf2fayekc
SHA256 be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a
MD5 d7451b2beea497446cb803bf9c364c95
SHA1 1311a1e44d99d56ba78d36cfd06eec2c9764d05f
SHA512 de15dd21bdc5593128f18e6f3d9a00bbd562f9f9fe11ba53d1bc9d11c030a783408ee93b6f46dd72a4773f5fe3653e93026d6dc853b4e69615bf38725382f0d1
SSDEEP 12288:wqEwY+Kpb4uhT0g3+oRAWwHBtgezcyRXxqSZeEUWOZw2:IBbLhT0gHgtgezcyRXxqSZeEUW
TLSH
T13FD45B20F9B0D136D8A344B2CDBDCA69443EBEA01B5554CBB3C8395E8A75DD17B32623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a

File Explorer

be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a

.exe 625KB

be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a

IMPHASH 819fb287144ebd3d082de4a12838e29b
SHA256 be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a
MD5 d7451b2beea497446cb803bf9c364c95
SHA1 1311a1e44d99d56ba78d36cfd06eec2c9764d05f
SHA512 de15dd21bdc5593128f18e6f3d9a00bbd562f9f9fe11ba53d1bc9d11c030a783408ee93b6f46dd72a4773f5fe3653e93026d6dc853b4e69615bf38725382f0d1
SSDEEP 12288:wqEwY+Kpb4uhT0g3+oRAWwHBtgezcyRXxqSZeEUWOZw2:IBbLhT0gHgtgezcyRXxqSZeEUW
TLSH
T13FD45B20F9B0D136D8A344B2CDBDCA69443EBEA01B5554CBB3C8395E8A75DD17B32623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

184725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\weasel\output\Win32\WeaselDeployer.pdb

rime

rime_get_api

kernel32

FindResourceExW GetThreadUILanguage SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx OutputDebugStringW CreateDirectoryW DecodePointer GetSystemWow64DirectoryW ExitProcess WaitForSingleObject FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LoadLibraryExW SetThreadUILanguage SetThreadLocale FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindResourceW GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue CreateMutexW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineA CloseHandle GetFileAttributesW GetUserDefaultUILanguage GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException SizeofResource LockResource LoadResource GetModuleFileNameW ExpandEnvironmentStringsW GetStdHandle VirtualQuery VirtualProtect AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionAndSpinCount SetEndOfFile WriteConsoleW ReadConsoleW SetStdHandle RtlUnwind GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc OpenEventA WaitForSingleObjectEx ReleaseSemaphore ResetEvent GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter FlsAlloc SleepConditionVariableSRW FormatMessageA FormatMessageW LocalFree CreateEventA SetEvent GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW

user32

MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW EnableWindow GetWindowLongW GetWindow BringWindowToTop EndDialog GetDlgItem SetWindowLongW DialogBoxParamW SetWindowPos UnregisterClassW MessageBoxExW GetActiveWindow MonitorFromWindow MessageBoxW SendMessageW LoadStringW DestroyWindow CharNextW GetKeyState CallWindowProcW DefWindowProcW SetWindowTextW

gdi32

GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteObject DeleteDC CreateDIBSection

advapi32

RegEnumKeyExW GetUserNameW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegDeleteKeyW RegGetValueW RegCloseKey

shell32

ShellExecuteExW ord155 SHOpenFolderAndSelectItems ord190

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoInitialize

oleaut32

VarUI4FromStr

gdiplus

GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdiplusStartup GdipGetImageHeight

comctl32

InitCommonControlsEx

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UText@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Name

.text

Size

367KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

be47e39dcf989f0be49baedbdc6be75b6b4820bfcef16a15ac2b265c3108271a

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

generic