8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad

Sharing

Copy URL Twitter E-mail

General

Target
8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad
Size 276KB
Sample261107-nn7dtscx2k
SHA256 8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad
MD5 c5d053f35021d88e3f9b3680b3bfa04d
SHA1 8a1d03e6c86be867731c714c8d8fe0ac97337b5c
SHA512 6763c2916a7d531bcb782ddd665c8389bd0c0ff1ef3191ed3d86069e6970b023129552072113c0a15eae12dc0c9428507e07c866be41a5012a59b7cbd3775209
SSDEEP 6144:mKFc1uu3ao0m/KOzv/8SBGmr8FqVdTmpManS0VtCXa:mKFc1vZ0m/bvkcPYEQqa
TLSH
T1D7545B4BB3A41CB9E57783B9CF529546E2B2B8553722C7CF27A0025A5F237D05A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad

File Explorer

8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad

.dll 276KB

8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad

IMPHASH b1cef2623e95fb601d818823ce63cca1
SHA256 8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad
MD5 c5d053f35021d88e3f9b3680b3bfa04d
SHA1 8a1d03e6c86be867731c714c8d8fe0ac97337b5c
SHA512 6763c2916a7d531bcb782ddd665c8389bd0c0ff1ef3191ed3d86069e6970b023129552072113c0a15eae12dc0c9428507e07c866be41a5012a59b7cbd3775209
SSDEEP 6144:mKFc1uu3ao0m/KOzv/8SBGmr8FqVdTmpManS0VtCXa:mKFc1vZ0m/bvkcPYEQqa
TLSH
T1D7545B4BB3A41CB9E57783B9CF529546E2B2B8553722C7CF27A0025A5F237D05A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\WiseCleaner\wjslib\x64\Release\WJSLib.pdb

shlwapi

PathFileExistsW

kernel32

GetModuleHandleW GetVolumePathNamesForVolumeNameW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte ReadFile SystemTimeToFileTime DosDateTimeToFileTime WriteFile DeviceIoControl WaitForSingleObject GetFileSizeEx SetEndOfFile UnmapViewOfFile FlushViewOfFile DeleteFileW SetFilePointerEx CreateFileMappingW MapViewOfFile VerSetConditionMask FindNextFileW FindClose ResetEvent ResumeThread TerminateThread CreateThread GetFileAttributesW FormatMessageW LocalFree WriteConsoleW GetProcAddress GetVolumeNameForVolumeMountPointW CreateFileW GetVolumeInformationW DeleteCriticalSection CloseHandle SetEvent GetFileAttributesExW GetLastError HeapSize LocalFileTimeToFileTime CreateEventW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection FindNextVolumeW FindVolumeClose FindFirstVolumeW FindFirstFileW GetCurrentThreadId InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW HeapReAlloc HeapAlloc HeapFree LCMapStringW GetStdHandle GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetStdHandle GetStringTypeW

advapi32

EncryptFileW DecryptFileW

shell32

SHGetFileInfoW

crypt32

CertAddCertificateContextToStore CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore PFXExportCertStoreEx CertFindCertificateInStore CertGetNameStringW CertOpenStore PFXImportCertStore CertGetCertificateContextProperty

??0IWJLibInterface@@QEAA@AEBU0@@Z ??0IWJLibInterface@@QEAA@XZ ??0IWJMftChangeHandler@@QEAA@$$QEAU0@@Z ??0IWJMftChangeHandler@@QEAA@AEBU0@@Z ??0IWJMftChangeHandler@@QEAA@XZ ??0IWJMftFileData@@QEAA@$$QEAU0@@Z ??0IWJMftFileData@@QEAA@AEBU0@@Z ??0IWJMftFileData@@QEAA@XZ ??0IWJMftFileRecord@@QEAA@$$QEAU0@@Z ??0IWJMftFileRecord@@QEAA@AEBU0@@Z ??0IWJMftFileRecord@@QEAA@XZ ??0IWJMftIndexFile@@QEAA@$$QEAU0@@Z ??0IWJMftIndexFile@@QEAA@AEBU0@@Z ??0IWJMftIndexFile@@QEAA@XZ ??0IWJMftReader@@QEAA@$$QEAU0@@Z ??0IWJMftReader@@QEAA@AEBU0@@Z ??0IWJMftReader@@QEAA@XZ ??0IWJMftSearchHandler@@QEAA@$$QEAU0@@Z ??0IWJMftSearchHandler@@QEAA@AEBU0@@Z ??0IWJMftSearchHandler@@QEAA@XZ ??0IWJSHandler@@QEAA@$$QEAU0@@Z ??0IWJSHandler@@QEAA@AEBU0@@Z ??0IWJSHandler@@QEAA@XZ ??0IWJVolume@@QEAA@$$QEAU0@@Z ??0IWJVolume@@QEAA@AEBU0@@Z ??0IWJVolume@@QEAA@XZ ??1IWJLibInterface@@UEAA@XZ ??4IWJLibInterface@@QEAAAEAU0@AEBU0@@Z ??4IWJMftChangeHandler@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftChangeHandler@@QEAAAEAU0@AEBU0@@Z ??4IWJMftFileData@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftFileData@@QEAAAEAU0@AEBU0@@Z ??4IWJMftFileRecord@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftFileRecord@@QEAAAEAU0@AEBU0@@Z ??4IWJMftIndexFile@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftIndexFile@@QEAAAEAU0@AEBU0@@Z ??4IWJMftReader@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftReader@@QEAAAEAU0@AEBU0@@Z ??4IWJMftSearchHandler@@QEAAAEAU0@$$QEAU0@@Z ??4IWJMftSearchHandler@@QEAAAEAU0@AEBU0@@Z ??4IWJSHandler@@QEAAAEAU0@$$QEAU0@@Z ??4IWJSHandler@@QEAAAEAU0@AEBU0@@Z ??4IWJVolume@@QEAAAEAU0@$$QEAU0@@Z ??4IWJVolume@@QEAAAEAU0@AEBU0@@Z ??_7IWJLibInterface@@6B@ ??_7IWJMftChangeHandler@@6B@ ??_7IWJMftFileData@@6B@ ??_7IWJMftFileRecord@@6B@ ??_7IWJMftIndexFile@@6B@ ??_7IWJMftReader@@6B@ ??_7IWJMftSearchHandler@@6B@ ??_7IWJSHandler@@6B@ ??_7IWJVolume@@6B@ WJCreateIndexFile WJCreateIndexFileEx WJGetShlDisplayName WJSChangeTime WJSClose WJSCloseHandle WJSCreateMftReader WJSCreationTime WJSDataClusters WJSDataClustersCount WJSDataOffset WJSDataSize WJSEnumDeleteFiles WJSEnumMftFiles WJSFileAttributes WJSFileDataInfo WJSFileName WJSFileNameLength WJSFilePath WJSFileReferences WJSFileSize WJSGetBytesPerSector WJSGetData WJSGetFile WJSGetFileSystem WJSGetMediaType WJSGetSectorsPerCluster WJSGetTotalCluster WJSGetTotalSize WJSGetVolume WJSGetVolumeCount WJSGetVolumeGuid WJSGetVolumeLabel WJSGetVolumePath WJSIndexFileClose WJSIndexFileStopListener WJSIsDir WJSLastAccessTime WJSLastWriteTime WJSMatchExpression WJSOpen WJSOpenHandle WJSParentDircetoryReferences WJSReadCluster WJSReadSector WJSRuns WJSSearchDeletedFile WJSSearchIndexFile WJSSearchVolume WJSSearchVolumeFast WJSSize WJSV1_CancelTask WJSV1_CreateTask WJSV1_CreateTaskFromScanResult WJSV1_ExportCertificate WJSV1_FreeCertificateList WJSV1_FreeScanResult WJSV1_FreeTaskList WJSV1_GetLastError WJSV1_GetTaskList WJSV1_GetTaskProgress WJSV1_GetTaskResult WJSV1_ImportCertificate WJSV1_Initialize WJSV1_ListCertificates WJSV1_PauseTask WJSV1_RemoveFinishedTasks WJSV1_RemoveTask WJSV1_ResumeTask WJSV1_ScanLocalFiles WJSV1_SetLogCallback WJSV1_Shutdown WJSV1_StartTask WJVolumeCanReader

Name

.text

Size

168KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8a20343a20d91e4c7d22418690d6988b411a6e715c63a531a3eadfac6e57acad

shlwapi

kernel32

advapi32

shell32

crypt32

generic