South[.]wtf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
South.wtf.exe
Size 672KB
Sample260818-rfjvcatdkd
SHA256 2bd3d7aed9277f204291ee2fb13ec68c8f92f7606a4715414d97df598fdcfb9e
MD5 ecd6b1cb7f31a39c6dc180a48f56ac54
SHA1 fb475d13b0cb92a897fd547e175c276f0cd41284
SHA512 56906268af8475576dc0cd709c3448ea4b3adc4091fc902fc3bc5d873b201e8e02dade4baa1a32107666a22c25fe217f120dea975333772effdf3d07161e044b
SSDEEP 6144:fj8Ye5YdFE3BkfYMmjNt9HoW0CNaa7LxHwJcRaokXWbYbG4sHulA9tLpvP2dPnnm:r8YFW0Cc+rRZmtsOQ8oHK30H8uwJ
TLSH
T1A9E46D2A9B9412BDE0B7D17ACE964952F772780B03B19EDF07D045A61F2B5E04F3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
South.wtf.exe

File Explorer

South.wtf.exe

.exe 672KB

South.wtf.exe

IMPHASH 3c0699e68ee626813cc1fb077ff95aaf
SHA256 2bd3d7aed9277f204291ee2fb13ec68c8f92f7606a4715414d97df598fdcfb9e
MD5 ecd6b1cb7f31a39c6dc180a48f56ac54
SHA1 fb475d13b0cb92a897fd547e175c276f0cd41284
SHA512 56906268af8475576dc0cd709c3448ea4b3adc4091fc902fc3bc5d873b201e8e02dade4baa1a32107666a22c25fe217f120dea975333772effdf3d07161e044b
SSDEEP 6144:fj8Ye5YdFE3BkfYMmjNt9HoW0CNaa7LxHwJcRaokXWbYbG4sHulA9tLpvP2dPnnm:r8YFW0Cc+rRZmtsOQ8oHK30H8uwJ
TLSH
T1A9E46D2A9B9412BDE0B7D17ACE964952F772780B03B19EDF07D045A61F2B5E04F3A312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

311184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption WinHttpConnect WinHttpSetTimeouts

advapi32

GetUserNameW AllocateAndInitializeSid FreeSid CheckTokenMembership OpenProcessToken AdjustTokenPrivileges RegCloseKey RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW LookupPrivilegeValueW

user32

GetWindowTextW GetClassNameW EnumWindows GetWindowLongPtrW GetAsyncKeyState GetWindow GetWindowTextLengthW GetWindowThreadProcessId GetWindowLongW GetForegroundWindow IsWindowVisible SetWindowLongPtrW IsWindow

kernel32

IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap FindNextFileW FindFirstFileExW FindClose HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect GetModuleFileNameA SetConsoleTextAttribute SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetConsoleWindowInfo GetConsoleScreenBufferInfoEx MultiByteToWideChar Sleep GetConsoleMode SetConsoleScreenBufferInfoEx LoadLibraryA GetProcAddress SetConsoleCP GetConsoleWindow SetConsoleOutputCP SetConsoleTitleW ReadFile MoveFileA GetCurrentProcess WriteFile SetStdHandle WriteConsoleOutputCharacterA CreateNamedPipeW SetSystemTime CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot GetTickCount64 GetLastError GetFileAttributesA Process32NextW DeleteFileA Process32FirstW CloseHandle GetSystemInfo CancelIoEx SetFileAttributesA CreateFileMappingA LocalFree ExitProcess ReadProcessMemory WideCharToMultiByte CreateDirectoryA ConnectNamedPipe VirtualQueryEx FlushFileBuffers CreateFileA GetModuleHandleW QueryFullProcessImageNameW GetCurrentThread GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent FreeLibraryAndExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileAttributesExW CreateProcessW GetExitCodeProcess GetFileType ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents HeapAlloc HeapFree HeapSize WriteConsoleW SetEndOfFile TerminateProcess RtlUnwind GetCommandLineW GetCommandLineA ExitThread GetModuleFileNameW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo WakeAllConditionVariable GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetConsoleCP CreateThread GetModuleHandleExW

shell32

ShellExecuteA ShellExecuteW SHGetFolderPathA

bcrypt

BCryptHashData BCryptGenerateSymmetricKey BCryptSetProperty BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptCreateHash BCryptEncrypt

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptBinaryToStringA CryptImportPublicKeyInfoEx2

secur32

GetUserNameExA

netapi32

NetApiBufferFree NetUserGetInfo

Name

.text

Size

502KB

Virtual Size

502KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

South.wtf.exe

winhttp

advapi32

user32

kernel32

shell32

bcrypt

crypt32

secur32

netapi32

generic