waifu-kingdom-windows[.]zip

Resubmissions

15/08/2026, 16:34

260815-t26mcazekc

15/08/2026, 16:25

260815-tw8jragg323

Sharing

Copy URL Twitter E-mail

General

Target
waifu-kingdom-windows.zip
Size 78.0MB
Sample260815-t26mcazekc
SHA256 181ac20e18e843820df761ebb0f997ae73a5e58b220d960c0957af9af7285bb9
MD5 96e4f5939f025a9e0050086c4b7a5995
SHA1 418022bce70a1fb735bd8701037caf272bbc91f2
SHA512 ea583df9044fe89f774b8373ac6ccf8b84f937f3dfc9e888e5d031819bfd172fb7bb86c0fec6c6993b966edb93d0baed0acd6b4f9bc8811aeb34a7ba546386c3
SSDEEP 1572864:mAIawvEHzxDw1LGqfNqQedVHFh0ekRIawvEHzxDw1LGqfNqQedVHFh0eu9Y:mAr0EHzwfXgn0Rr0EHzwfXgne9Y
TLSH
T1CD083306E921BD2763A45435CFE3CD1C5A7F4E9859213C8A581278F632D22BBAF64C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Waifu Kingdom.console.exe
unpack001/Waifu Kingdom.exe
unpack001/Waifu Kingdom.exe.truncated

File Explorer

waifu-kingdom-windows.zip

.zip 78.0MB
Waifu Kingdom.console.exe

.exe 197KB
Waifu Kingdom.exe

.exe 104.2MB
Waifu Kingdom.exe.truncated

.exe 104.1MB
Waifu Kingdom.pck

3.4MB

waifu-kingdom-windows.zip

SHA256 181ac20e18e843820df761ebb0f997ae73a5e58b220d960c0957af9af7285bb9
MD5 96e4f5939f025a9e0050086c4b7a5995
SHA1 418022bce70a1fb735bd8701037caf272bbc91f2
SHA512 ea583df9044fe89f774b8373ac6ccf8b84f937f3dfc9e888e5d031819bfd172fb7bb86c0fec6c6993b966edb93d0baed0acd6b4f9bc8811aeb34a7ba546386c3
SSDEEP 1572864:mAIawvEHzxDw1LGqfNqQedVHFh0ekRIawvEHzxDw1LGqfNqQedVHFh0eu9Y:mAr0EHzwfXgn0Rr0EHzwfXgne9Y
TLSH
T1CD083306E921BD2763A45435CFE3CD1C5A7F4E9859213C8A581278F632D22BBAF64C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Waifu Kingdom.console.exe

IMPHASH 15d4c42c7edb08fc0cb7ef2393ae246f
SHA256 81719d77c3b3866ca7c8971a856cdd75e2e0b5603ca49feb8e0fce262f00edfd
MD5 e0d2bd384e926b6194b622ec896e7029
SHA1 8e6400218583903fcc6c4e1874fe7034bd0e447e
SHA512 03e616bfab03ebf05d36c9eae35af914f4d4ae0e992cd6a144aed387f77d8c66e7b2476322d2e811b4a1197727e0b449ebc3604510620985c894fac2fde43cc2
SSDEEP 3072:9bpHXdPfRG2yuzW9YaM5S/c9+SBDypVoJNUarbAJM5LCxCAH8myKIaSWe:91Nj7axa+SBDyroLrKM5yHzLE
TLSH
T14614F106E39382BCC15B81B56AE34AB2EAB1FC6114649F7F4320C7715D39E805E79B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AssignProcessToJobObject CloseHandle CreateIoCompletionPort CreateJobObjectW CreateProcessW DeleteCriticalSection EnterCriticalSection GetCommandLineW GetConsoleMode GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetQueuedCompletionStatus GetStdHandle InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar ResumeThread SetConsoleMode SetConsoleTitleW SetInformationJobObject SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery __C_specific_handler

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func fwprintf __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _lock _snwprintf_s _unlock abort atexit calloc exit fprintf fputwc free localeconv malloc memcpy memset signal strerror strlen strncmp vfprintf wcslen

shell32

StrRStrIW

shlwapi

PathGetArgsW

Name

.text

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Waifu Kingdom.exe

IMPHASH f19b38ff87751a8009cde123a9c20e48
SHA256 34f2cdd877db5f1c4b129b03d82dfab2c499748a6ad7659457e55eb098723cd5
MD5 434f5a50fc614394dc0c97403197f1de
SHA1 d7b9db924bd9d19ff6d8a14b3d849c589537008d
SHA512 537c1eadb0e146ca46dcdf9b48e14637827fd7bcb2c4bb55df0b5ebb503aae73a7bdbb428a05d390b14b4052c2ccbdcfda50bf4cd1b5e1deb8c12226197f0d62
SSDEEP 786432:Xcmyjf1VYlSXxQnpJ9c7YUd4/KpRaFuQmhzyb4pbMAM2M8:Xcmuf1VYlShQpdUsKpBC4pbMAM2M
TLSH
T150383B53F27370ECC56BC13492DBA633BA73B85951386E6AD6A0CB742F21E50632DE14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

DuplicateHandle LoadLibraryExA AcquireSRWLockExclusive AcquireSRWLockShared AddDllDirectory AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareFileTime CompareStringOrdinal ConnectNamedPipe CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleProcessList GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetGeoInfoW GetHandleInformation GetLargePageMinimum GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetShortPathNameW GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultUILanguage GetUserGeoID GetVolumeInformationW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSRWLock InterlockedPushEntrySList IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent K32GetPerformanceInfo K32GetProcessMemoryInfo LCIDToLocaleName LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile Module32FirstW Module32NextW MoveFileExA MoveFileW MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PowerClearRequest PowerCreateRequest PowerSetRequest QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveDllDirectory RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlUnwindEx SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableA SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadIdealProcessor SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrlenW

ntdll

RtlNtStatusToDosError NtQueryInformationFile NtWriteFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysAllocStringLen VariantClear SysAllocString SysFreeString SysStringLen VariantInit

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

user32

ActivateKeyboardLayout AdjustWindowRectEx AllowSetForegroundWindow CallNextHookEx CallWindowProcW ClientToScreen ClipCursor CreateCaret CreateIconFromResourceEx CreateIconIndirect CreatePopupMenu CreateWindowExA CreateWindowExW DefWindowProcW DestroyCaret DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EndDialog EnumChildWindows EnumDisplayMonitors EnumDisplaySettingsW EnumWindows FillRect FlashWindowEx GetAsyncKeyState GetClientRect GetCursorPos GetDC GetDCEx GetDlgItem GetDoubleClickTime GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenuItemCount GetMenuItemInfoW GetMenuItemRect GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoA GetMonitorInfoW GetParent GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUpdateRect GetWindowLongPtrA GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InsertMenuItemW IsIconic IsProcessDPIAware IsWindowVisible IsZoomed KillTimer LoadCursorA LoadIconA LoadIconW MapVirtualKeyA MapVirtualKeyExA MessageBoxW MonitorFromWindow MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageA PostThreadMessageW RegisterClassExA RegisterClassExW RegisterClassW RegisterDeviceNotificationW RegisterRawInputDevices ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient SendInput SendMessageA SendMessageW SetCapture SetCaretPos SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetPropW SetTimer SetWindowDisplayAffinity SetWindowLongPtrA SetWindowLongPtrW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExA ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification WindowFromPoint AttachThreadInput CloseClipboard CloseTouchInputHandle DisplayConfigGetDeviceInfo EmptyClipboard GetClipboardData GetDisplayConfigBufferSizes GetPointerPenInfo GetPointerType GetTouchInputInfo IsClipboardFormatAvailable IsWindow LogicalToPhysicalPointForPerMonitorDPI MessageBeep OpenClipboard PhysicalToLogicalPointForPerMonitorDPI QueryDisplayConfig RegisterClipboardFormatA RegisterTouchWindow SetClipboardData WindowFromDC

advapi32

GetCurrentHwProfileA RegOpenKeyW

avrt

AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenSystemStoreA CryptBinaryToStringA

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory1

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreatePolygonRgn CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetPixel GetTextExtentPoint32W SelectObject SetDIBitsToDevice SetPixelFormat SwapBuffers

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetProductString HidP_GetCaps

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionFontA ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses GetBestInterfaceEx

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

api-ms-win-core-registry-l1-1-0

RegCloseKey RegEnumKeyExW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func fwprintf __set_app_type __setusermatherr _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _cexit _chsize _commode _endthreadex _errno _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _getmaxstdio _getpid _gmtime64 _hypot _initterm _itoa_s _lock _lseeki64 _set_error_mode _setjmp _setmaxstdio _strdup _stricmp _time64 _timezone _tzname _tzset _unlock _vscprintf _vsnprintf _vsnprintf_s _wchdir _wfopen _wfopen_s _wfsopen _wgetcwd abort acos atexit asin atan atof atoi bsearch calloc ceil clock cosh exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fputwc fread free freopen_s fseek fsetpos ftell fwrite getc getenv getwc isalnum isalpha isdigit isspace iswctype iswspace isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror putc putchar puts putwc qsort rand realloc remove rewind setbuf setlocale setvbuf signal sinh srand strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strstr strtol strtoul strxfrm tan tanh tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcstol wcstombs wcsxfrm _vsnprintf_s _fstat _strtoui64 _strtoi64 _nextafter _write _stricmp _strdup _read _memicmp _fileno _fdopen

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize GetErrorInfo OleInitialize OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop SetErrorInfo

shcore

GetDpiForMonitor SetProcessDpiAwareness

shell32

CommandLineToArgvW DragAcceptFiles DragQueryFileW SHCreateItemFromParsingName SHFileOperationW SHGetKnownFolderPath SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

shlwapi

QISearch SHLoadIndirectString SHStrDupW

winmm

midiInClose midiInGetDevCapsA midiInGetErrorTextA midiInGetNumDevs midiInOpen midiInStart midiInStop timeBeginPeriod timeEndPeriod timeGetDevCaps

ws2_32

WSAConnect freeaddrinfo getaddrinfo getnameinfo inet_pton

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getsockname htonl htons inet_addr ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt socket

Name

.text

Size

79.4MB

Virtual Size

79.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

961KB

Virtual Size

961KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

19.4MB

Virtual Size

19.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pck

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

390KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Waifu Kingdom.exe.truncated

IMPHASH f19b38ff87751a8009cde123a9c20e48
SHA256 c0f3c26db82a18711655843e7e71fa4e763d8506163ecf022d0b5de47fc53e53
MD5 a22e752749ec6b56b9cbffbc5e1142a7
SHA1 b73267be8330c39c50243c0b8f784d33c46bb31b
SHA512 cc73e2b9839e7ee23b17faf76304000aa34e78051c38c3a5ab709a6281b3c214244b03ee4c8f534884f80e84377975154d47d0b25f1a72e3e93fda3365b5e9eb
SSDEEP 786432:Zcmyjf1VYlSXxQnpJ9c7YUd4/KpRaFuQmhzyb4pbMAM2M8:Zcmuf1VYlShQpdUsKpBC4pbMAM2M
TLSH
T1BE383B53F27370ECC56BC13492DBA633BA73B85951386E6AD6A0CB742F21E50632DE14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

ntdll

RtlNtStatusToDosError NtQueryInformationFile NtWriteFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysAllocStringLen VariantClear SysAllocString SysFreeString SysStringLen VariantInit

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

user32

advapi32

GetCurrentHwProfileA RegOpenKeyW

avrt

AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenSystemStoreA CryptBinaryToStringA

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory1

gdi32

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetProductString HidP_GetCaps

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionFontA ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses GetBestInterfaceEx

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

api-ms-win-core-registry-l1-1-0

RegCloseKey RegEnumKeyExW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

msvcrt

ole32

shcore

GetDpiForMonitor SetProcessDpiAwareness

shell32

shlwapi

QISearch SHLoadIndirectString SHStrDupW

winmm

midiInClose midiInGetDevCapsA midiInGetErrorTextA midiInGetNumDevs midiInOpen midiInStart midiInStop timeBeginPeriod timeEndPeriod timeGetDevCaps

ws2_32

WSAConnect freeaddrinfo getaddrinfo getnameinfo inet_pton

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getsockname htonl htons inet_addr ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt socket

Name

.text

Size

79.4MB

Virtual Size

79.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

961KB

Virtual Size

961KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

19.4MB

Virtual Size

19.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pck

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

390KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

waifu-kingdom-windows.zip

Waifu Kingdom.console.exe

kernel32

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

msvcrt

shell32

shlwapi

generic

Waifu Kingdom.exe

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

oleaut32

uiautomationcore

user32

advapi32

avrt

bcrypt

crypt32

dwmapi

dwrite

dxgi

gdi32

hid

imm32

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

msvcrt

ole32

shcore

shell32

shlwapi

winmm

ws2_32

wsock32

generic

Waifu Kingdom.exe.truncated

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

oleaut32

uiautomationcore

user32

advapi32

avrt

bcrypt

crypt32

dwmapi

dwrite

dxgi

gdi32

hid

imm32

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

msvcrt

ole32

shcore

shell32

shlwapi

winmm

ws2_32

wsock32