wslx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wslx.exe
Size 11.8MB
Sample260916-xyssvsda73
SHA256 a6c21c26b2bb812b70e5261e5cf79d9ad6b12904342b83e38fa5e9a3e4a6d808
MD5 edc0cf0fb795b3abeadfb65896c75767
SHA1 7f09dcae40507eeec37e1df14c02260a5dcdf1b9
SHA512 9e404aeec2cf79848febe3ffb49d594e16f36f693c473afd651cafa7267731ba6ba5021b79f3c2375aa6e9b8fdf70931f1a2692d118c67fb864d46ac949e9ffc
SSDEEP 98304:URV4yeoNPUIJ7Q4/DjphnG4ZuxgtE1+CJTdRox+sej3ec:UIVYX7Q4rjvnDIdRoxn
TLSH
T10BC64B01BA9B98ECD16AC870834646736E2134CB0B26B9FF45D441393F6ABE46F3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wslx.exe

File Explorer

wslx.exe

.exe 11.8MB

wslx.exe

IMPHASH 082dd8394a7cb53e3900d6f482c1cf94
SHA256 a6c21c26b2bb812b70e5261e5cf79d9ad6b12904342b83e38fa5e9a3e4a6d808
MD5 edc0cf0fb795b3abeadfb65896c75767
SHA1 7f09dcae40507eeec37e1df14c02260a5dcdf1b9
SHA512 9e404aeec2cf79848febe3ffb49d594e16f36f693c473afd651cafa7267731ba6ba5021b79f3c2375aa6e9b8fdf70931f1a2692d118c67fb864d46ac949e9ffc
SSDEEP 98304:URV4yeoNPUIJ7Q4/DjphnG4ZuxgtE1+CJTdRox+sej3ec:UIVYX7Q4rjvnDIdRoxn
TLSH
T10BC64B01BA9B98ECD16AC870834646736E2134CB0B26B9FF45D441393F6ABE46F3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8763992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wslx.pdb

bcryptprimitives

ProcessPrng

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CompareStringW ConvertFiberToThread ConvertThreadToFiber CreateDirectoryW CreateFiber CreateFileMappingW CreateFileW CreateMutexA CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFiber DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultLocaleName GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW MapViewOfFile MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetEnvironmentVariableA SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToFiber SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

advapi32

CredDeleteW CredFree CredReadW CredWriteW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

oleaut32

GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

bcrypt

BCryptGenRandom

user32

CloseClipboard CountClipboardFormats CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnumClipboardFormats EnumDisplayMonitors GetActiveWindow GetClientRect GetClipboardData GetClipboardFormatNameW GetCursorPos GetDoubleClickTime GetDpiForWindow GetKeyState GetKeyboardLayoutNameW GetMessageW GetMonitorInfoW GetSystemMetrics GetSystemMetricsForDpi GetWindowLongPtrW GetWindowPlacement GetWindowRect IsClipboardFormatAvailable IsIconic IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadImageW MapVirtualKeyW MessageBoxW MonitorFromPoint MonitorFromWindow OpenClipboard PostMessageW PostQuitMessage RedrawWindow RegisterClassW RegisterClipboardFormatW ReleaseCapture ScreenToClient SendInput SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindow ShowWindowAsync SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage ValidateRect

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoIncrementMTAUsage CoTaskMemFree OleInitialize OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop

dxgi

CreateDXGIFactory2 DXGIGetDebugInterface1

gdi32

CreateSolidBrush

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompileFromFile

dcomp

DCompositionCreateDevice

dwrite

DWriteCreateFactory

shell32

DragQueryFileW SHAppBarMessage SHCreateItemFromParsingName SHGetDesktopFolder SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmSetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

imm32

ImmGetCompositionStringW ImmGetContext ImmGetVirtualKey ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

comctl32

TaskDialogIndirect

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockopt ioctlsocket recv select send setsockopt

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

icuuc

u_strlen

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

132KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

481B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wslx.exe

bcryptprimitives

kernel32

advapi32

oleaut32

bcrypt

user32

ole32

dxgi

gdi32

d3d11

d3dcompiler_47

dcomp

dwrite

shell32

dwmapi

api-ms-win-shcore-scaling-l1-1-1

imm32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

ntdll

comctl32

ws2_32

api-ms-win-core-synch-l1-2-0

icuuc

generic