IwaraTool-Windows-AMD64-v1[.]1[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IwaraTool-Windows-AMD64-v1.1.1.exe
Size 30.8MB
Sample261014-mxtnnaby4y
SHA256 ed9c81b4d0cdc05c4b690e022f0de953303c7032bbf0f88f4dd46c9e57aa393e
MD5 4e4e4f27c3923bf39b07a51ae295f09c
SHA1 33b8f358321bd2c96f2c939353aea842da597ca6
SHA512 a4bc4396a7918499e4eda6a35887fcb5eaf9b0fd1e82505cd22220780068c60f652075342065244507c2d0e816b08296aea5c4540f0063f19ad1cffc1a606b77
SSDEEP 786432:+AawkozKwrLBzBb5EGW35I6jyWpMKhdWKLZGbaCEFcrU4:Baw5KGLBNb5EGWxylKhDZGOd
TLSH
T19467338A791182C9DE3CE936808BD4126F393D734398768242E5FE1EB7F15DAC86C356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IwaraTool-Windows-AMD64-v1.1.1.exe

File Explorer

IwaraTool-Windows-AMD64-v1.1.1.exe

.exe 30.8MB

IwaraTool-Windows-AMD64-v1.1.1.exe

IMPHASH 31725385009a1b77aed0a625d620125b
SHA256 ed9c81b4d0cdc05c4b690e022f0de953303c7032bbf0f88f4dd46c9e57aa393e
MD5 4e4e4f27c3923bf39b07a51ae295f09c
SHA1 33b8f358321bd2c96f2c939353aea842da597ca6
SHA512 a4bc4396a7918499e4eda6a35887fcb5eaf9b0fd1e82505cd22220780068c60f652075342065244507c2d0e816b08296aea5c4540f0063f19ad1cffc1a606b77
SSDEEP 786432:+AawkozKwrLBzBb5EGW35I6jyWpMKhdWKLZGbaCEFcrU4:Baw5KGLBNb5EGWxylKhDZGOd
TLSH
T19467338A791182C9DE3CE936808BD4126F393D734398768242E5FE1EB7F15DAC86C356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

LockResource GetModuleHandleW GetStartupInfoW IsDebuggerPresent CreateDirectoryW SizeofResource SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError GetCurrentThreadId CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW GetSystemTimeAsFileTime FormatMessageA LoadLibraryExW GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead

vcruntime140

wcschr __C_specific_handler __current_exception __current_exception_context memset memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___wargv terminate _crt_atexit abort _seh_filter_exe _set_app_type _errno _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _exit _cexit _c_exit _register_thread_local_exe_atexit_callback __p___argc _register_onexit_function _initialize_onexit_table exit

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

mbstowcs wcstoul

api-ms-win-crt-stdio-l1-1-0

puts __stdio_common_vsprintf __stdio_common_vfprintf __stdio_common_vswprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsdup iswctype _wcsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale