watajudensex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
watajudensex.exe
Size 4.4MB
Sample261020-j49rnsbs8m
SHA256 fd197b5332cc41d847e01fc23e6a57aeba28e85d0d2710b1ecf97fb7cfe9f7ba
MD5 a28042f9d76e8abff8972efe05911d79
SHA1 53d9a7b8fd3536c9768c1d179559c037b3f552fa
SHA512 c2695e712553c9d617a4631bf7a3853447b6b80a42e044954d3b541bdde73ae16e675a19f49aa6d7d2bc69d21f4db2a6c635071347518a727cd1f876cce4b0ad
SSDEEP 98304:jAoiV0rrEhSI3UUPMo/Wui0S60Cj4bh+u:pXr6UUPoufS4Mb
TLSH
T1C926CF2C5605F0BCEB87B2328667AB924B54E139C7D349F742444EE3BF129959E33263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
watajudensex.exe

File Explorer

watajudensex.exe

.exe 4.4MB

watajudensex.exe

IMPHASH f8e0e8ea70d69425eba82e43766c4e63
SHA256 fd197b5332cc41d847e01fc23e6a57aeba28e85d0d2710b1ecf97fb7cfe9f7ba
MD5 a28042f9d76e8abff8972efe05911d79
SHA1 53d9a7b8fd3536c9768c1d179559c037b3f552fa
SHA512 c2695e712553c9d617a4631bf7a3853447b6b80a42e044954d3b541bdde73ae16e675a19f49aa6d7d2bc69d21f4db2a6c635071347518a727cd1f876cce4b0ad
SSDEEP 98304:jAoiV0rrEhSI3UUPMo/Wui0S60Cj4bh+u:pXr6UUPoufS4Mb
TLSH
T1C926CF2C5605F0BCEB87B2328667AB924B54E139C7D349F742444EE3BF129959E33263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1046832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteValueA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA CryptAcquireContextA CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptImportKey CryptDecrypt ConvertSidToStringSidA

user32

GetWindowThreadProcessId GetSystemMetrics GetCursorPos GetShellWindow SystemParametersInfoA

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z _Query_perf_counter _Query_perf_frequency ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ

oleaut32

SysAllocString SysFreeString SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear GetErrorInfo SetErrorInfo VariantChangeType CreateErrorInfo

mscoree

CLRCreateInstance

iphlpapi

GetAdaptersAddresses

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW QueryPerformanceCounter IsProcessorFeaturePresent K32GetModuleFileNameExA Process32Next Process32First CreateToolhelp32Snapshot GetUserDefaultUILanguage GetSystemDefaultUILanguage GetComputerNameA MoveFileExW CopyFileA LocalFree LoadLibraryA GetProcAddress GetModuleHandleA GetModuleFileNameW GetModuleFileNameA WriteProcessMemory VirtualProtectEx VirtualAllocEx VirtualProtect VirtualAlloc GetWindowsDirectoryA GetSystemDirectoryA GetTickCount64 GetModuleHandleW GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW SetEnvironmentVariableA CreateDirectoryA CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileAttributesW GetTempFileNameW ReadFile SetFileAttributesA SetFileInformationByHandle WriteFile GetTempPathW GetTempPathA CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError CreatePipe HeapAlloc HeapFree GetProcessHeap HeapWalk WaitForSingleObject CreateMutexA Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread GetCurrentThread ResumeThread CreateProcessA CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTime GetTickCount

vcruntime140

__current_exception_context _except_handler4_common __std_type_info_destroy_list memchr memcmp memcpy memmove memset __std_exception_copy __std_exception_destroy _CxxThrowException __CxxFrameHandler3 __std_terminate __current_exception

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen tolower strlen strncpy_s _stricmp

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf_s __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-heap-l1-1-0

_callnewh calloc _set_new_mode free malloc

api-ms-win-crt-math-l1-1-0

sin __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _crt_at_quick_exit _execute_onexit_table _seh_filter_dll terminate _initialize_onexit_table _seh_filter_exe _set_app_type _controlfp_s _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _register_onexit_function _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale