WZTernal[.]exe | Triage™

Resubmissions

10/08/2026, 05:58

260810-gn9qmaed69

10/08/2026, 05:57

260810-gnmabssdja3

Sharing

Copy URL Twitter E-mail

General

Target
WZTernal.exe
Size 1.7MB
Sample260810-gnmabssdja
SHA256 ce040da3cf955cc58678adebe62a197792bad60c099921ee95d2175a4e7706d2
MD5 104eca13219fb2cce38082eafd8cd475
SHA1 a0b3a1c14b7eb4716c4227c86fe93839366d33f4
SHA512 92f110a82ba382d751adfeb3bbf10a45d2cc45e0b5cd305a309ac5d614ec10eb3aee8c281e169cf5254ed56bab422b68243a9fc32199067321f3ed75588c1747
SSDEEP 49152:6lzMek5Bp90yFGlC8Zm0SmjOZJb3Ct2CSUYxzID1MKn3ik:LekPcy860/m3Ct2CSUYxzo1M
TLSH
T1DC85D01A52E900FDC7A7C07CC52A561BE3B2784D136096EB23E485B52F637E81B7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WZTernal.exe

File Explorer

WZTernal.exe

.exe 1.7MB

WZTernal.exe

IMPHASH 0d34ec6acbc83b9ad84b71cbb7546a39
SHA256 ce040da3cf955cc58678adebe62a197792bad60c099921ee95d2175a4e7706d2
MD5 104eca13219fb2cce38082eafd8cd475
SHA1 a0b3a1c14b7eb4716c4227c86fe93839366d33f4
SHA512 92f110a82ba382d751adfeb3bbf10a45d2cc45e0b5cd305a309ac5d614ec10eb3aee8c281e169cf5254ed56bab422b68243a9fc32199067321f3ed75588c1747
SSDEEP 49152:6lzMek5Bp90yFGlC8Zm0SmjOZJb3Ct2CSUYxzID1MKn3ik:LekPcy860/m3Ct2CSUYxzo1M
TLSH
T1DC85D01A52E900FDC7A7C07CC52A561BE3B2784D136096EB23E485B52F637E81B7E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1022584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LocalFree CreateToolhelp32Snapshot GetModuleFileNameA SubmitThreadpoolWork CreateThreadpoolWork CloseThreadpool CreateThreadpool OpenProcess GetCurrentProcess CloseHandle GetTempPathA InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RemoveDirectoryA GetFileSizeEx CreateFileA VerifyVersionInfoW SleepEx WaitForMultipleObjects FindNextFileA FindFirstFileA FindClose DeleteFileA FindResourceW SizeofResource LockResource LoadResource FindResourceExW SetUnhandledExceptionFilter VirtualProtectEx CreateRemoteThread Process32FirstW RtlAddFunctionTable FreeConsole CreateMutexA GetLocaleInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte PeekNamedPipe ReadFile GetFileType GetStdHandle GetCurrentProcessId GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetSystemDirectoryA CreateEventA WaitForSingleObject MultiByteToWideChar ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId FormatMessageA GetLocaleInfoEx CreateFileW FindFirstFileW GetExitCodeProcess Process32NextW GlobalFree GlobalLock GlobalUnlock GlobalAlloc VirtualAlloc DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError WakeAllConditionVariable FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx IsDebuggerPresent OutputDebugStringW SetLastError FormatMessageW GetTickCount

user32

DefWindowProcW GetKeyState GetForegroundWindow LoadCursorA ScreenToClient OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsWindowUnicode ReleaseCapture SetCapture GetCapture ClientToScreen SetCursorPos GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout SetCursor GetCursorPos GetClientRect

advapi32

RegOpenKeyExA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey RegCloseKey OpenProcessToken GetTokenInformation GetUserNameW RegDeleteKeyA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW CryptEncrypt CryptImportKey RegEnumValueA SetSecurityInfo GetSecurityInfo SetEntriesInAclW ConvertSidToStringSidW ConvertSidToStringSidA RegDeleteTreeA RegQueryValueExA RegOpenKeyExW RegEnumValueW CryptAcquireContextA

shell32

SHGetKnownFolderPath ShellExecuteA

ole32

CoTaskMemFree CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize CoSetProxyBlanket

oleaut32

SysFreeString VariantClear SysAllocString

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setf@ios_base@std@@QEAAHHH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Random_device@std@@YAIXZ ??7ios_base@std@@QEBA_NXZ

userenv

GetUserProfileDirectoryA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

normaliz

IdnToAscii IdnToUnicode

wldap32

ord26 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord217 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

iphlpapi

GetAdaptersInfo

ws2_32

socket __WSAFDIsSet select accept bind connect getsockname gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSASetLastError WSAGetLastError WSAStartup WSACleanup setsockopt WSAIoctl htons ntohs

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler __current_exception __current_exception_context memcmp memmove strrchr strstr memset memcpy _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate wcsstr memchr strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

abort __sys_errlist __sys_nerr _errno _exit exit _configure_narrow_argv _invoke_watson _initterm_e _initialize_onexit_table _register_onexit_function _c_exit _initterm _get_narrow_winmain_command_line terminate _set_app_type _initialize_narrow_environment _seh_filter_exe _beginthreadex _invalid_parameter_noinfo _crt_atexit _cexit _register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc realloc free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcscmp strcspn strncmp strpbrk wmemcpy_s wcslen strncpy strspn _strdup strlen _wcsicmp toupper iswupper iswprint iswalpha strcmp _stricmp

api-ms-win-crt-stdio-l1-1-0

fwrite ftell fseek fread fflush __stdio_common_vsprintf __stdio_common_vsscanf _close _fileno _lseeki64 _wfopen fgets _write __stdio_common_vswprintf fopen __acrt_iob_func ungetc setvbuf _fseeki64 fsetpos fputc fgetpos fgetc _get_stream_buffer_pointers feof fputs _read fclose __p__commode _set_fmode __stdio_common_vsprintf_s __stdio_common_vswprintf_s _open

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-math-l1-1-0

acosf fmodf cosf sinf _dclass ceilf __setusermatherr sqrtf _fdopen

api-ms-win-crt-convert-l1-1-0

strtoull strtod strtoll strtol atoll atoi strtoul wcstombs

api-ms-win-crt-filesystem-l1-1-0

_stat64 _wremove _unlink _unlock_file _access _lock_file _fstat64

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp