Wabbitemu 2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Wabbitemu 2.exe
Size 4.6MB
Sample260924-r3d8dafd64
SHA256 6cebce1ed45f77ca971281862cc9c9d0085dbc3504a9f1f9a717496cce51c829
MD5 d51c7eae547145543a51ab35c763877d
SHA1 1d1adb266bd1416d3f4199a393d82452debcdc4b
SHA512 e06e4acdca09a93d8321c80c0ae250c87b082cb55179427cd9e542709fd340446e7de2b1037b96a97d1669c1636bbd77ea9998b0227486b85b5a3ed6297103e2
SSDEEP 98304:gE0MukNJ7eOGlbFr9tHXsF0q3VfOknidky3r8W53IStnivkgCl/VtBCYFZrF6/ES:g7HYe7DrH0Oxdj5YSthSqHzAu3GKtf+/
TLSH
T1C7263365948171B9D8616C35892BFDE68909B8034E9336771D0BCBFD8977EC38BC720A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
Wabbitemu 2.exe
unpack001/out.upx

File Explorer

Wabbitemu 2.exe

.exe 4.6MB
out.upx

.exe 5.4MB

Wabbitemu 2.exe

SHA256 6cebce1ed45f77ca971281862cc9c9d0085dbc3504a9f1f9a717496cce51c829
MD5 d51c7eae547145543a51ab35c763877d
SHA1 1d1adb266bd1416d3f4199a393d82452debcdc4b
SHA512 e06e4acdca09a93d8321c80c0ae250c87b082cb55179427cd9e542709fd340446e7de2b1037b96a97d1669c1636bbd77ea9998b0227486b85b5a3ed6297103e2
SSDEEP 98304:gE0MukNJ7eOGlbFr9tHXsF0q3VfOknidky3r8W53IStnivkgCl/VtBCYFZrF6/ES:g7HYe7DrH0Oxdj5YSthSqHzAu3GKtf+/
TLSH
T1C7263365948171B9D8616C35892BFDE68909B8034E9336771D0BCBFD8977EC38BC720A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9645296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=5, id=241, version=40116,

count=187, id=243, version=40116,

count=15, id=242, version=40116,

count=1, id=199, version=41118,

count=10, id=259, version=23406,

count=23, id=260, version=23406,

count=49, id=261, version=23406,

count=2, id=261, version=23013,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=135, version=30729,

count=8, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=158, productName=VS2010 build 30319, version=30319,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=476, id=1, productName=Unmarked objects,

count=104, id=265, version=23506,

count=1, id=255, productName=VS2015 UPD1 build 23506, version=23506,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD1 build 23506, version=23506,

out.upx

SHA256 6862cfc423a22c7d103b70c528a42d2d7fd0f881573ea00b2a0495ab87bec736
MD5 e3667fa0c387e75e770eda0a3ea0bdd6
SHA1 c2530eea39ca2282834875482c354fec386c9f58
SHA512 a8e971509ac79f2dc76292e57d76d83367d92546e9a3cd7a65599e18a60fba58ea54c17b8834249c084cf3f4f0abd10a7d7c5a342e7b4701ae29ef2fbd11469d
SSDEEP 98304:FgoqrJtMqYVOFDfVsx7WAwYtSngE+zk0H/tk0fBQKA1R45nXdkC3XLP5rVdXkDA:dqrJ2qYVOu77Dtv3zAgeMFrgk
TLSH
T16A46F160BBB452B4F0E18538B4157992DAB138925BE197FF5690371B7F33AE20B3A704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

647KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

165KB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=5, id=241, version=40116,

count=187, id=243, version=40116,

count=15, id=242, version=40116,

count=1, id=199, version=41118,

count=10, id=259, version=23406,

count=23, id=260, version=23406,

count=49, id=261, version=23406,

count=2, id=261, version=23013,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=135, version=30729,

count=8, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=158, productName=VS2010 build 30319, version=30319,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=476, id=1, productName=Unmarked objects,

count=104, id=265, version=23506,

count=1, id=255, productName=VS2015 UPD1 build 23506, version=23506,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD1 build 23506, version=23506,