PCWrecker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PCWrecker.exe
Size 1.2MB
Sample261009-xmmsgadh84
SHA256 7709362cbc7bd5dcf0a36aa7a90f7e55ca22074195bc690381966547554489f9
MD5 209eeca55abe171f64c26df7e5013fab
SHA1 d62b4dab4ad93738cd0bf9799daf33a9c2274315
SHA512 baeedebf9397cd047bc36037c5b7bfe71535ff2f1a29b64e241a8ea14da3bac6f888f35247ec249a5819475e707625a917228e887a112a5523313f7f6cf3e6bc
SSDEEP 24576:kpx6wOIqMaV2zUneioNmFlmXex5ouqiZ/iP9AQ:BD2Ie3Nm7XoudiP6
TLSH
T183550226E2D504FAF8378238CA424946EA75F8471754DACF67604A723E77BC06E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PCWrecker.exe

File Explorer

PCWrecker.exe

.exe 1.2MB

PCWrecker.exe

IMPHASH e4246a14b2f9006a5f0af714428f53e1
SHA256 7709362cbc7bd5dcf0a36aa7a90f7e55ca22074195bc690381966547554489f9
MD5 209eeca55abe171f64c26df7e5013fab
SHA1 d62b4dab4ad93738cd0bf9799daf33a9c2274315
SHA512 baeedebf9397cd047bc36037c5b7bfe71535ff2f1a29b64e241a8ea14da3bac6f888f35247ec249a5819475e707625a917228e887a112a5523313f7f6cf3e6bc
SSDEEP 24576:kpx6wOIqMaV2zUneioNmFlmXex5ouqiZ/iP9AQ:BD2Ie3Nm7XoudiP6
TLSH
T183550226E2D504FAF8378238CA424946EA75F8471754DACF67604A723E77BC06E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes GetDlgCtrlID PostMessageA KillTimer GetSystemMetrics DrawTextA GetDC ReleaseDC BeginPaint EndPaint InvalidateRect DefWindowProcA SendMessageA TranslateMessage DispatchMessageA SetTimer GetClientRect SystemParametersInfoA LoadCursorA SetWindowLongPtrA GetWindowLongPtrA FillRect MessageBoxA GetMessageA

gdi32

SetTextColor SetBkMode SetBkColor SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC

shell32

ShellExecuteExA

shlwapi

ord12 PathRemoveFileSpecA

gdiplus

GdiplusShutdown GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameCount GdiplusStartup GdipAlloc GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI GdipImageSelectActiveFrame GdipFree GdipCreateBitmapFromStream

winmm

mciSendStringA

advapi32

GetUserNameA FreeSid CheckTokenMembership AllocateAndInitializeSid

kernel32

FindNextFileW FindFirstFileExW HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType HeapAlloc EnumSystemLocalesW GetUserDefaultLCID GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle IsValidCodePage IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc CreateFileW HeapSize WriteConsoleW SetEndOfFile Sleep ExitProcess CreateThread GetTickCount GetTickCount64 GetModuleFileNameA GetEnvironmentVariableA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA ReadFile RemoveDirectoryA SetFileAttributesA GetTempPathA CloseHandle CreatePipe WaitForSingleObject TerminateProcess CreateProcessA OpenProcess LoadResource LockResource SizeofResource FindResourceA CreateToolhelp32Snapshot Process32First Process32Next GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError

Name

.text

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

939KB

Virtual Size

938KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PCWrecker.exe

user32

gdi32

shell32

shlwapi

gdiplus

winmm

advapi32

kernel32

generic