weorps[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
weorps.exe
Size 6.1MB
Sample261001-rxvyyaec72
SHA256 c05691369110ab8470a46c0b3d7f7e4bfa9b61cfd2104dc52a9908bf94420625
MD5 7a1252dbe92e098e2bd949081657d5d0
SHA1 10a154707c2eb27b92750bb58cfd0e5cc1044bb0
SHA512 daa273b94f4c187ac7d1666b2d47e83ff21ee0bbaadd3e1502faf505136622a9ad9618206088739d711706414b52e60a425aeddb0e0e1c3852ceae151d6ca1e7
SSDEEP 49152:suPeiu9ryjkRDG7iD2dqEjLpPqH/ZlEqINCRgpA1/hDrPnQAt:suu1ywRDIBdHLpiH/Zl1IMRg4t
TLSH
T1C0567AB18A9C9B4DF06AB079C2835627A7F1BC0C6721DF8B9AD09DB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
weorps.exe

File Explorer

weorps.exe

.exe 6.1MB

weorps.exe

IMPHASH ce625f417eaf3636a525b3bfa5e9cb19
SHA256 c05691369110ab8470a46c0b3d7f7e4bfa9b61cfd2104dc52a9908bf94420625
MD5 7a1252dbe92e098e2bd949081657d5d0
SHA1 10a154707c2eb27b92750bb58cfd0e5cc1044bb0
SHA512 daa273b94f4c187ac7d1666b2d47e83ff21ee0bbaadd3e1502faf505136622a9ad9618206088739d711706414b52e60a425aeddb0e0e1c3852ceae151d6ca1e7
SSDEEP 49152:suPeiu9ryjkRDG7iD2dqEjLpPqH/ZlEqINCRgpA1/hDrPnQAt:suu1ywRDIBdHLpiH/Zl1IMRg4t
TLSH
T1C0567AB18A9C9B4DF06AB079C2835627A7F1BC0C6721DF8B9AD09DB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6169412

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

winhttp

WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpCloseHandle

kernel32

IsDebuggerPresent GetStartupInfoW GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter ReleaseSRWLockExclusive Sleep GetTickCount64 OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle K32GetModuleBaseNameA ReadProcessMemory WideCharToMultiByte K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleHandleW WriteProcessMemory InitializeSListHead UnhandledExceptionFilter AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable K32GetModuleInformation GetSystemTimeAsFileTime

user32

DefWindowProcW CreateWindowExW MapWindowPoints MoveWindow SetWindowLongW SetForegroundWindow GetKeyState GetMessageExtraInfo ScreenToClient TranslateMessage GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event GetClientRect GetSystemMetrics GetAsyncKeyState DispatchMessageW PeekMessageW GetWindowLongW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

d3dx10_43

D3DXVec3Transform

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception __std_exception_destroy __std_exception_copy __std_terminate strstr memchr memcmp memcpy memset memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _wfopen fputc _set_fmode fseek freopen _get_stream_buffer_pointers _fseeki64 __p__commode fread fsetpos ftell __stdio_common_vfprintf ungetc setvbuf fgetpos fflush fclose __acrt_iob_func __stdio_common_vsprintf fwrite fgetc

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm _beginthreadex _invoke_watson exit _c_exit _exit _get_wide_winmain_command_line terminate _errno _initialize_onexit_table _register_onexit_function _crt_atexit _initialize_wide_environment _cexit _seh_filter_exe _set_app_type _initterm_e _configure_wide_argv

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strcmp isxdigit strncmp strncpy strcpy_s isdigit _wcsicmp tolower

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtol strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-math-l1-1-0

atan2f sinf ceilf acosf cosf sqrtf powf roundf _dclass __setusermatherr fmodf