SMM_WE[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SMM_WE.exe
Size 97.7MB
Sample261017-s8y1eah15t
SHA256 ad9004805d04cd58da8ac9a3aea7d03f2ddb886e5f154dda9daadca763f67108
MD5 a21cb5b0f432886e501ddc9d77171baa
SHA1 6bbff9d50e84ec7c69dd58b59fee129ab8618cfb
SHA512 483c84bf0ab04c1410f1fc38a931b64d59a95793055d3be789a5416141646eec1d9bb9ed7bb39a603362b6619c7043da943d1245a887cc1f2be8cc7726b987df
SSDEEP 3145728:/XKMZfMDiTrIp4xtrOS5lFa/kvLlL9DsVbhbX:QiwOxBp5Dvhq1h
TLSH
T16328D040F717E0E5CE4116B4306BA22FFA346D00D47E9F93DBE17A1BDB72616292E960
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SMM_WE.exe

File Explorer

SMM_WE.exe

.exe 97.7MB

SMM_WE.exe

IMPHASH 2a380984738e7745692144a27d9e7e99
SHA256 ad9004805d04cd58da8ac9a3aea7d03f2ddb886e5f154dda9daadca763f67108
MD5 a21cb5b0f432886e501ddc9d77171baa
SHA1 6bbff9d50e84ec7c69dd58b59fee129ab8618cfb
SHA512 483c84bf0ab04c1410f1fc38a931b64d59a95793055d3be789a5416141646eec1d9bb9ed7bb39a603362b6619c7043da943d1245a887cc1f2be8cc7726b987df
SSDEEP 3145728:/XKMZfMDiTrIp4xtrOS5lFa/kvLlL9DsVbhbX:QiwOxBp5Dvhq1h
TLSH
T16328D040F717E0E5CE4116B4306BA22FFA346D00D47E9F93DBE17A1BDB72616292E960
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16501831

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetConnectA HttpOpenRequestA HttpSendRequestA InternetCanonicalizeUrlA InternetCrackUrlA InternetOpenA HttpQueryInfoA InternetReadFile InternetCloseHandle InternetGetConnectedState

d3dx9_43

D3DXGetPixelShaderProfile D3DXGetImageInfoFromFileInMemory D3DXCreateTextureFromFileInMemoryEx D3DXCreateTextureFromFileW D3DXGetVertexShaderProfile D3DXCompileShader

dbghelp

SymFromAddr SymInitialize

winmm

joyGetPos joyGetDevCapsA joyGetPosEx mciSendStringA mciGetErrorStringA

ws2_32

ntohs htonl htons getpeername __WSAFDIsSet select freeaddrinfo WSAGetLastError closesocket sendto connect inet_addr shutdown WSAStartup getsockopt setsockopt ioctlsocket socket bind getaddrinfo send recvfrom inet_ntoa recv accept listen

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

kernel32

GetTempPathA FindFirstFileExW HeapWalk HeapValidate SetFileAttributesW GetFileAttributesExW ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FindFirstFileExA LoadLibraryExA GetDriveTypeW SetEnvironmentVariableW SetEnvironmentVariableA GetFileInformationByHandle PeekNamedPipe ReadConsoleW SetFilePointer MoveFileExW FindNextFileA FileTimeToLocalFileTime lstrlenA GlobalAlloc GlobalLock GlobalUnlock SetPriorityClass GetCurrentDirectoryA SetCurrentDirectoryA SetThreadPriority TlsSetValue TlsAlloc CreateWaitableTimerW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency GetTickCount GetConsoleWindow CreateDirectoryW GetFileAttributesW FindFirstFileW RemoveDirectoryW FindNextFileW FindClose SetEndOfFile GlobalMemoryStatusEx EncodePointer DecodePointer GetCommandLineA GetLastError HeapFree InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar HeapSize Sleep IsProcessorFeaturePresent SetLastError InterlockedIncrement GetCurrentThread GetCurrentThreadId GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess GetModuleHandleW IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InterlockedExchange FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc HeapReAlloc RtlUnwind OutputDebugStringW LoadLibraryW GetTimeFormatEx GetDateFormatEx CompareStringEx GetLocaleInfoEx GetUserDefaultLocaleName LCMapStringEx IsValidLocaleName EnumSystemLocalesEx GetStringTypeW RaiseException FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW ExpandEnvironmentStringsW MoveFileA GetFullPathNameW SetErrorMode GetCommandLineW GetCurrentProcessId RtlCaptureStackBackTrace GetEnvironmentVariableW GetVersionExW GetUserDefaultLCID GetLocaleInfoW GetSystemInfo GetCurrentDirectoryW LocalFree FormatMessageW CreateThread GetExitCodeThread DeleteFileW GetExitCodeProcess CreateProcessW

user32

DialogBoxParamW GetDlgItem DrawTextW ScreenToClient keybd_event EndDialog GetDlgItemTextW SetDlgItemTextW MapWindowPoints GetMonitorInfoW GetAsyncKeyState SetDlgItemTextA EnumDisplayDevicesA GetRawInputDeviceInfoA GetRawInputDeviceList CreateDialogParamW MoveWindow MessageBoxA PostMessageW IsDialogMessageW DispatchMessageW TranslateMessage PeekMessageW SetFocus ReleaseDC GetDC MessageBoxW wsprintfW GetSystemMetrics EnumDisplaySettingsW ChangeDisplaySettingsW GetCursorPos SetCursorPos SetWindowPos AdjustWindowRectEx GetWindowRect SendMessageW SetWindowLongW ShowWindow UpdateWindow GetClientRect EnumDisplaySettingsExW GetKeyState SetCapture ReleaseCapture DefWindowProcW SetCursor CreateWindowExW RegisterClassExW LoadCursorW LoadImageW SetForegroundWindow BringWindowToTop DestroyWindow GetActiveWindow SetWindowTextA IsClipboardFormatAvailable CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetFocus SetWindowTextW ClientToScreen GetForegroundWindow

gdi32

GetDeviceCaps SelectObject

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysAllocString SysFreeString VariantClear

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

18.2MB

Virtual Size

18.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77.3MB

Virtual Size

79.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mydata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

898KB

Virtual Size

898KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SMM_WE.exe

wininet

d3dx9_43

dbghelp

winmm

ws2_32

gdiplus

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

generic