42ec3e4310f0ec1b4abe95a9827105c3789ccf078112f9555a6ffc8910cfbfdb
- SHA256 42ec3e4310f0ec1b4abe95a9827105c3789ccf078112f9555a6ffc8910cfbfdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WTAGA_v1710.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
WTAGA_v1710.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 42ec3e4310f0ec1b4abe95a9827105c3789ccf078112f9555a6ffc8910cfbfdb
- Size 1.5MB
- Sample260809-ta5kzabb85
- SHA256 42ec3e4310f0ec1b4abe95a9827105c3789ccf078112f9555a6ffc8910cfbfdb
- MD5 b7643570f1734b025bb1cc9ad50d6dc2
- SHA1 a96399f370a82f42935ae88503c6b48505359361
- SHA512 10bd12332c8b1d1449a6e6f8f0e95a7cec335824dbb84803167c4ae3123a8feb2aa575d3daf7b6a49e3f70e44352d6a3512e14506cad0f7a0591e3520adb2b4d
- SSDEEP 49152:oWjueda7uK9OQp3sSUHUnfhPbbvxHvrNrQMo:njjdal9OQp8SxfhzlzNQMo
- TLSH T192753340663310FA6D65EEC94DE0F4409CA9D65F24A2E5FB98EDC4320C66F5A8F6F384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WTAGA_v1710.exe
File Explorer
-
42ec3e4310f0ec1b4abe95a9827105c3789ccf078112f9555a6ffc8910cfbfdb.zip 1.5MB
-
WTAGA_v1710.exe.exe 2.9MB
WTAGA_v1710.exe
- IMPHASH 41b4b48ea4c74771d27e59288570dc6a
- SHA256 58c0bc3a56d9ef254d1fead66ca77548e4d3a06938c36fb62465aa3ad7b78517
- MD5 a45db9ac24b8cc732366104d3298d8cd
- SHA1 5e213e3a78b6e6a95b79e89368477f7de55e6776
- SHA512 f1a4c6ce493febd20df47ab54fe4bcc843b32c64894dbf3a0d05d15bcc4339b97a01f341f4251c67bdc582e6d8b4e0c0b0ad52e7964e6487b505831bfaaaa416
- SSDEEP 49152:0HlZ623uKkLi5pnkWhQOZYjxjcBnnjCXWL5WWL:e32/LfjOZYR0j8Wo
- TLSH T12FE59E46B3B900F8D46BC178891A561BE7B274051370DBDB46E0CA6E6F23EE11E7E724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
961448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
UnregisterClassW
RegisterClassExW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
DefWindowProcA
UpdateWindow
GetDC
ReleaseDC
ValidateRect
GetWindowRect
GetCursorPos
FillRect
GetWindowLongA
PostQuitMessage
PeekMessageA
DispatchMessageA
GetAsyncKeyState
TranslateMessage
LoadCursorA
FindWindowW
SetWindowLongA
gdi32
TextOutW
MoveToEx
CreateDIBSection
SetTextColor
SetBkMode
BitBlt
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
GetStockObject
LineTo
PatBlt
Rectangle
SelectObject
shell32
CommandLineToArgvW
SHGetFolderPathA
ShellExecuteExW
advapi32
CheckTokenMembership
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
FreeSid
GetUserNameA
AllocateAndInitializeSid
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
winmm
timeEndPeriod
timeBeginPeriod
ws2_32
bind
closesocket
connect
ioctlsocket
htons
inet_addr
listen
accept
send
setsockopt
socket
WSAStartup
WSACleanup
WSAGetLastError
recv
dwmapi
DwmExtendFrameIntoClientArea
kernel32
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
ReadConsoleW
LCMapStringW
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
WriteConsoleW
FormatMessageA
GetConsoleMode
GetConsoleOutputCP
GetFileType
GetCommandLineA
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RtlPcToFileHeader
CreateDirectoryA
CreateFileA
DeleteFileA
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileSize
GetFullPathNameA
ReadFile
RemoveDirectoryA
SetFilePointer
WriteFile
CloseHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
WaitForMultipleObjects
GetCurrentProcess
CreateThread
GetExitCodeThread
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
LocalFree
FileTimeToDosDateTime
GetComputerNameA
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
RtlUnwind
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
RaiseException
TryEnterCriticalSection
GetCurrentThreadId
GetCommandLineW
GetFileAttributesExA
SetFileAttributesA
GetVolumeInformationA
QueryPerformanceFrequency
DeviceIoControl
ExitProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
GetTickCount64
GetSystemDirectoryA
ReadProcessMemory
GetModuleFileNameW
SetConsoleTitleA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InitializeSListHead
RtlUnwindEx
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=30795,
count=162, id=261, version=30795,
count=17, id=260, version=30795,
count=10, id=259, version=33731,
count=17, id=260, version=33731,
count=48, id=261, version=33731,
count=17, id=257, version=30795,
count=254, id=1, productName=Unmarked objects,
count=3, id=260, version=33821,
count=1, id=261, version=33821,
count=1, id=258, version=33821,