WOMicClient (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WOMicClient (1).exe
Size 520KB
Sample261030-xtf89sfx8p
SHA256 09a628da065b598dc06f299e64dc398a4dfa149b1001ab9f1862c83f9904ea5c
MD5 7f7cada9e7f5f1f362cea8ae77345e21
SHA1 cc619b5e4176f9660f802337c2dbe2d50ae1db32
SHA512 2412efe575be4eed55acc39ff36c23ef0c4453658557031b5bf1d7430853dba0cb0174859e362bee35d4e57c1f18ca52616aa88ebac66567f5385faf875726dc
SSDEEP 6144:hskytam3P9d/aycf7e85xfkWYWJobB/rQmX3FFOU4rlsaIfrjR0TzP5ePo:ykyQQP9Qze8WbB/NX3FsvrlsnzNaxeQ
TLSH
T106B46A227612CC72D59E0272D92AEEBE54297E2C1B1211D3F6C43F5FD8346DE2A34786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WOMicClient (1).exe

File Explorer

WOMicClient (1).exe

.exe 520KB

WOMicClient (1).exe

IMPHASH e3895100ad18c1f32b3899c4de88eed6
SHA256 09a628da065b598dc06f299e64dc398a4dfa149b1001ab9f1862c83f9904ea5c
MD5 7f7cada9e7f5f1f362cea8ae77345e21
SHA1 cc619b5e4176f9660f802337c2dbe2d50ae1db32
SHA512 2412efe575be4eed55acc39ff36c23ef0c4453658557031b5bf1d7430853dba0cb0174859e362bee35d4e57c1f18ca52616aa88ebac66567f5385faf875726dc
SSDEEP 6144:hskytam3P9d/aycf7e85xfkWYWJobB/rQmX3FFOU4rlsaIfrjR0TzP5ePo:ykyQQP9Qze8WbB/NX3FsvrlsnzNaxeQ
TLSH
T106B46A227612CC72D59E0272D92AEEBE54297E2C1B1211D3F6C43F5FD8346DE2A34786
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

181721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\projects\3_WOMic\4_src\1a_womicclient\womicclient\Release\WOMicClient.pdb

advapi32

RegOpenKeyExW RegSetValueExW RegCloseKey RegQueryValueExW

bthprops.cpl

BluetoothSdpGetString BluetoothFindDeviceClose BluetoothSdpGetAttributeValue BluetoothSdpGetContainerElementData BluetoothFindFirstDevice BluetoothFindNextDevice

ws2_32

select closesocket bind __WSAFDIsSet send getsockopt WSAStartup WSACleanup recv getaddrinfo freeaddrinfo getnameinfo WSALookupServiceEnd WSAGetLastError setsockopt WSALookupServiceBeginW WSAAddressToStringW connect socket WSALookupServiceNextW

winmm

waveOutUnprepareHeader waveOutOpen timeEndPeriod timeBeginPeriod timeGetDevCaps waveOutWrite waveOutClose waveOutPrepareHeader

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

kernel32

QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent GetProcAddress CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExW CreateMutexW GetModuleHandleW GetLocalTime GetCurrentProcess SetPriorityClass GetCurrentThreadId SetThreadExecutionState GetTickCount GetNativeSystemInfo WideCharToMultiByte MultiByteToWideChar GetProcessHeap HeapAlloc GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcessId ReadFile CreatePipe WaitForSingleObject Sleep GetLastError CloseHandle CreateProcessW ReleaseSemaphore CreateSemaphoreW CreateThreadpool WaitForThreadpoolTimerCallbacks SetThreadpoolThreadMinimum SetThreadpoolThreadMaximum CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer SetThreadPriority CreateThread HeapFree WriteFile DeviceIoControl CreateFileW

user32

wsprintfW DialogBoxParamW GetMessageW DefWindowProcW LoadMenuW GetMenu DeleteMenu RegisterClassExW LoadAcceleratorsW GetSubMenu DispatchMessageW TranslateAcceleratorW TranslateMessage FindWindowW LoadCursorW FlashWindowEx CheckMenuItem PostQuitMessage EnableMenuItem SetProcessDPIAware UpdateWindow IsIconic BeginPaint EndPaint CreatePopupMenu TrackPopupMenu LoadIconW InsertMenuW SetForegroundWindow GetCursorPos CreateWindowExW GetDlgItem DestroyWindow CheckDlgButton MessageBoxW LoadStringW ShowWindow IsDlgButtonChecked EnableWindow GetWindowRect SetWindowPos SendMessageW EndDialog

shell32

Shell_NotifyIconW ShellExecuteW SHGetKnownFolderPath

ole32

StringFromGUID2

msvcp140

?_XGetLastError@std@@YAXXZ ?_Syserror_map@std@@YAPBDH@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Cnd_broadcast _Cnd_destroy_in_situ _Cnd_signal _Mtx_current_owns ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_timedwait _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Xbad_function_call@std@@YAXXZ ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z _Cnd_init_in_situ ?__ExceptionPtrCreate@@YAXPAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AAE@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z _Mtx_unlock _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ ?_Throw_C_error@std@@YAXH@Z _Xtime_get_ticks _Thrd_sleep ??0_Locinfo@std@@QAE@PBD@Z ??1_Locinfo@std@@QAE@XZ ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??Bid@locale@std@@QAEIXZ ?_Incref@facet@locale@std@@UAEXXZ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ??0facet@locale@std@@IAE@I@Z ??1facet@locale@std@@MAE@XZ ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPBD@Z ?id@?$ctype@D@std@@2V0locale@2@A _Strxfrm ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

vcruntime140

strchr __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 _CxxThrowException _purecall wcsstr memmove _except_handler4_common __current_exception_context __current_exception memcpy memset strrchr

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit abort _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn terminate _beginthreadex _controlfp_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fflush __stdio_common_vswscanf __stdio_common_vsnprintf_s fwrite fread feof fclose fopen __p__commode __stdio_common_vsprintf _set_fmode __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

_wtoi wcstombs

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale