weedhack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
weedhack.exe
Size 1.5MB
Sample261009-wp49vscw2t
SHA256 99eaffe2ef6fb29a5de16b78755ce66ff1dedb641da9446fb826a69eb22d03b0
MD5 b670d1246955762428dbb7818bf32769
SHA1 e30b034523ece3c05f601b4dee80c2d6051a3e56
SHA512 73790de9e3cde5f6c827f1f915702aae73bb7c5fc6ace1fa6e22e31be06513ec8a2c239f6f9ca2dbbc900c22346fda126924c182c3bbaf2064f0dde805f49fc3
SSDEEP 24576:+My2rvmUc4HxrhkndBT8ASRxl2rLEomw81k+0BcXjPvFaY+nM:rW4AdBBSRxUrLEomw81fjPvFaY+nM
TLSH
T15D756CB37552259ED2A3A5B98263533B743A334532327BB32D98BE306F96DC10F5A344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
weedhack.exe

File Explorer

weedhack.exe

.exe 1.5MB

weedhack.exe

IMPHASH 7d35b7374335003c147a56ed5a843b93
SHA256 99eaffe2ef6fb29a5de16b78755ce66ff1dedb641da9446fb826a69eb22d03b0
MD5 b670d1246955762428dbb7818bf32769
SHA1 e30b034523ece3c05f601b4dee80c2d6051a3e56
SHA512 73790de9e3cde5f6c827f1f915702aae73bb7c5fc6ace1fa6e22e31be06513ec8a2c239f6f9ca2dbbc900c22346fda126924c182c3bbaf2064f0dde805f49fc3
SSDEEP 24576:+My2rvmUc4HxrhkndBT8ASRxl2rLEomw81k+0BcXjPvFaY+nM:rW4AdBBSRxUrLEomw81fjPvFaY+nM
TLSH
T15D756CB37552259ED2A3A5B98263533B743A334532327BB32D98BE306F96DC10F5A344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList IsThreadAFiber LeaveCriticalSection LoadLibraryA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx __C_specific_handler lstrlenW

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

ntdll

NtCreateFile NtCreateNamedPipeFile NtOpenFile NtReadFile NtSetInformationFile NtWriteFile RtlNtStatusToDosError

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

Name

.text

Size

818KB

Virtual Size

817KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

weedhack.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

userenv

ws2_32

generic