WechsenLoader[.]exe

General

Target
WechsenLoader.exe
Size 291KB
Sample260804-2qjbnsscmd
SHA256 cc6f8763975c50e39e6af1624758d15813e257349f6a74cd1038a695e313b6ac
MD5 88fb3a1eb14a8c9bb89ad72d4dbcd881
SHA1 422f679438ac8f167129c33e7e52c9acaf74ff04
SHA512 bdaf03cd30fb41b19064f449a5bb153e490d34b2ad17cf44b0f8fbe4f732423705dc9f31da1e925f6bec5b7a5dcef40ae8879243d91968b237e5c9f97d1d0edc
SSDEEP 3072:VR2sYURvYRgb3dWadjxGw/xkMSieRMMadGIKKndpeyABe3DFB9Aggw9/cF/1/arm:Fn3JV7enadGI5dz7D/lct/LOz
TLSH
T1CC544A1AF6A520F5D9B7C13CC942151AFE7278964360E7CB17904A972F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WechsenLoader.exe

File Explorer

WechsenLoader.exe

.exe 291KB

WechsenLoader.exe

IMPHASH 48d3c43a141ecd7b324ac0bee3825ee1
SHA256 cc6f8763975c50e39e6af1624758d15813e257349f6a74cd1038a695e313b6ac
MD5 88fb3a1eb14a8c9bb89ad72d4dbcd881
SHA1 422f679438ac8f167129c33e7e52c9acaf74ff04
SHA512 bdaf03cd30fb41b19064f449a5bb153e490d34b2ad17cf44b0f8fbe4f732423705dc9f31da1e925f6bec5b7a5dcef40ae8879243d91968b237e5c9f97d1d0edc
SSDEEP 3072:VR2sYURvYRgb3dWadjxGw/xkMSieRMMadGIKKndpeyABe3DFB9Aggw9/cF/1/arm:Fn3JV7enadGI5dz7D/lct/LOz
TLSH
T1CC544A1AF6A520F5D9B7C13CC942151AFE7278964360E7CB17904A972F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

56892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

kernel32

IsProcessorFeaturePresent WriteConsoleW CreateFileW HeapSize GetStdHandle GetFileAttributesA CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessA SetConsoleTextAttribute SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProcessHeap RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CreateProcessW GetFileAttributesExW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

Name

.text

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WechsenLoader.exe

shell32

urlmon

kernel32

generic