WonderSTC[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WonderSTC.exe
Size 1.2MB
Sample260817-althaszekf
SHA256 eba8f059508104e1fc7bf9407e3f7eba159dc9097fcb8570500c2d75b7c959ff
MD5 047a465c111359fd52eccb2e10d5a29b
SHA1 175d7ab7b9910993c54b3a8015b1f362eb673690
SHA512 6964d711c6cf9f53cb97f8984409463fee528ad8ce4de745da91c8b2d2cddc24b7d194ae692c654a8994b9a2217558ebd85f6d82bdb5acf5fa697b0a3a7bc331
SSDEEP 12288:kgQly18C/XGhPJYmUwoRkUV5LtYzpPlvbiFnAb:k9y18CqP2mBobydlDiFnU
TLSH
T1B5453856E64548AAC453423445E2E23BEB3E3C741722839B26ED7D733EB2ED17DA1342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WonderSTC.exe

File Explorer

WonderSTC.exe

.exe 1.2MB

WonderSTC.exe

IMPHASH 8119d7a11319de1c9eeba654aca79839
SHA256 eba8f059508104e1fc7bf9407e3f7eba159dc9097fcb8570500c2d75b7c959ff
MD5 047a465c111359fd52eccb2e10d5a29b
SHA1 175d7ab7b9910993c54b3a8015b1f362eb673690
SHA512 6964d711c6cf9f53cb97f8984409463fee528ad8ce4de745da91c8b2d2cddc24b7d194ae692c654a8994b9a2217558ebd85f6d82bdb5acf5fa697b0a3a7bc331
SSDEEP 12288:kgQly18C/XGhPJYmUwoRkUV5LtYzpPlvbiFnAb:k9y18CqP2mBobydlDiFnU
TLSH
T1B5453856E64548AAC453423445E2E23BEB3E3C741722839B26ED7D733EB2ED17DA1342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

353452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError GetFileAttributesA Process32NextW CreateFileA Process32Next Process32FirstW CloseHandle CreateThread GetLocalTime GetProcAddress ExitProcess GetModuleHandleW GetTickCount AllocConsole VirtualQueryEx GetModuleFileNameA GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess Process32First IsDebuggerPresent UnhandledExceptionFilter GetCurrentThreadId SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId MultiByteToWideChar

user32

LoadCursorA GetWindowRect DispatchMessageA GetWindow GetKeyState GetWindowThreadProcessId MapVirtualKeyA GetKeyNameTextA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard DestroyWindow ReleaseCapture SetCursor SetCapture IsChild GetCapture ScreenToClient IsWindowVisible RegisterClassA EnumWindows DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetWindowPos GetSystemMetrics GetClassNameA ShowWindow GetAsyncKeyState SetWindowLongA ClientToScreen GetWindowLongA SetWindowDisplayAffinity BringWindowToTop GetForegroundWindow SetCursorPos SendInput GetCursorPos TranslateMessage mouse_event UpdateWindow GetClientRect FindWindowA SetWindowLongPtrA GetDesktopWindow PostQuitMessage UnregisterClassA GetWindowLongPtrA PeekMessageA MoveWindow

gdi32

GetStockObject

msvcp140

_Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency

xinput1_4

ord2

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memchr strrchr strstr __std_terminate memmove __std_exception_copy __std_exception_destroy memcpy memcmp

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fread _wfopen fwrite fseek __p__commode fopen __acrt_iob_func _set_fmode ftell fflush __stdio_common_vsprintf_s freopen_s _open_osfhandle __stdio_common_vsscanf __stdio_common_vfscanf __stdio_common_vfprintf __stdio_common_vsprintf fgets fclose

api-ms-win-crt-runtime-l1-1-0

_c_exit _invoke_watson system _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_thread_local_exe_atexit_callback _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _register_onexit_function _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argv __p___argc

api-ms-win-crt-string-l1-1-0

strncpy strcpy_s wcsncpy_s tolower _wcsicmp _stricmp strncmp strcmp

api-ms-win-crt-math-l1-1-0

fminf fmaxf sinf _fdclass ceilf _fdopen acosf _finite fmodf sqrtf cosf __setusermatherr

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale