WinCache[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WinCache.exe
Size 10.7MB
Sample260819-pcfbmsap4x
SHA256 86f2102b23d572c9e9a3a8bad6087662b90e7543896a5b9f706c15ccca8d5792
MD5 77c1b815008321c67568b4390dd1432e
SHA1 efc3c757dbf86f86ba90f973c0c42352abc9dbb1
SHA512 de370f52387009043e3296e648395b8531467fa037c0e0837d0f6de2b4b9dee98a7f7a2b9d93ba16823fac97ead9c17baf889cf0cb2444c1d21d6f8fff7212c6
SSDEEP 196608:1batgCLp70Cr0qWOJeuR7kBJjnIXZBEfGg68iC/KBj:1Twd0iQnIjvg68iCSBj
TLSH
T1DEB6DFF721CA4671D2D3833A85536633F9635E41CA40DC236DF69E35160A1E8BB2BADC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinCache.exe

File Explorer

WinCache.exe

.exe 10.7MB

WinCache.exe

IMPHASH 6e319f1e5e58f1176de86ad3248d7302
SHA256 86f2102b23d572c9e9a3a8bad6087662b90e7543896a5b9f706c15ccca8d5792
MD5 77c1b815008321c67568b4390dd1432e
SHA1 efc3c757dbf86f86ba90f973c0c42352abc9dbb1
SHA512 de370f52387009043e3296e648395b8531467fa037c0e0837d0f6de2b4b9dee98a7f7a2b9d93ba16823fac97ead9c17baf889cf0cb2444c1d21d6f8fff7212c6
SSDEEP 196608:1batgCLp70Cr0qWOJeuR7kBJjnIXZBEfGg68iC/KBj:1Twd0iQnIjvg68iCSBj
TLSH
T1DEB6DFF721CA4671D2D3833A85536633F9635E41CA40DC236DF69E35160A1E8BB2BADC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid InitializeSecurityDescriptor RegCloseKey RegOpenKeyExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl

kernel32

CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateFileA CreateFileMappingW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl EnterCriticalSection ExitProcess FindResourceW FlushFileBuffers FormatMessageA FreeConsole GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemInfo GetTempPathA GetThreadContext GetThreadId GetTickCount64 GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileAttributesW SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile __C_specific_handler lstrcatA lstrcpyA lstrcpyW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _onexit strncpy_s _wcsicmp abort calloc exit fprintf fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc signal strchr strcmp strerror strlen strncmp strtoul towlower vfprintf wcslen _read

shell32

ShellExecuteExA

user32

GetCursorPos GetSystemMetrics ShowWindow

Name

.text

Size

651KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Shizoid

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

925B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WinCache.exe

advapi32

kernel32

msvcrt

shell32

user32

generic