WanySad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WanySad.exe
Size 3.2MB
Sample260816-qda9raydkd
SHA256 f02befc6db49eb723ddb54d0a754930a81124b37c5e67711b78a0ca817e388e7
MD5 d488274b6bca85e0ff66f00d74b5ee12
SHA1 3c327c92af8614145d7679fbb91ae32f4d390d56
SHA512 b27c972d2404cfffed9b5056fef39b14922bfbdffc2d497d18355d4fbedef1889e0283821987976941cfb03183951871d85ea121de346dff2f7fc5e341a17d05
SSDEEP 49152:x5S5MS3pHhdAfrvpwxfEddJAlsKQBaH65hNs8JyPjoxb:B4pK3Aln65hNs8JyPjoxb
TLSH
T161E5F843A9DB0DE9CED677B865C71335A738FD718A291F2B6A08C2312D536C4AD1EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WanySad.exe

File Explorer

WanySad.exe

.exe 3.2MB

WanySad.exe

IMPHASH 98a038a5d5cbf1bb4d54053fa1098f6a
SHA256 f02befc6db49eb723ddb54d0a754930a81124b37c5e67711b78a0ca817e388e7
MD5 d488274b6bca85e0ff66f00d74b5ee12
SHA1 3c327c92af8614145d7679fbb91ae32f4d390d56
SHA512 b27c972d2404cfffed9b5056fef39b14922bfbdffc2d497d18355d4fbedef1889e0283821987976941cfb03183951871d85ea121de346dff2f7fc5e341a17d05
SSDEEP 49152:x5S5MS3pHhdAfrvpwxfEddJAlsKQBaH65hNs8JyPjoxb:B4pK3Aln65hNs8JyPjoxb
TLSH
T161E5F843A9DB0DE9CED677B865C71335A738FD718A291F2B6A08C2312D536C4AD1EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptExportKey CryptGenKey CryptGenRandom CryptHashData CryptImportKey CryptReleaseContext RegCloseKey RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegSetValueExA

gdi32

CreateFontW CreatePen CreateSolidBrush DeleteObject GetStockObject RoundRect SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateFileW CreateHardLinkW CreateMutexA CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LocalFree MoveFileExW OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_errno _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _chsize_s _close _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _wopen _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp isspace iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

SHGetFolderPathA ShellExecuteA

shlwapi

PathFileExistsA

user32

BeginPaint CreateWindowExA CreateWindowExW DefWindowProcA DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetMessageW GetWindowTextA MessageBoxA PostQuitMessage RegisterClassW ShowWindow SystemParametersInfoA TranslateMessage UpdateWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

1008KB

Virtual Size

1007KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

986B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WanySad.exe

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

shlwapi

user32

winhttp

generic