AutoWording-v0[.]2[.]0-windows-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AutoWording-v0.2.0-windows-x64.exe
Size 26.1MB
Sample261110-xmkccacz2x
SHA256 f0bc6a7b6ec896c6c637d5d836499c23a1b0cb1cf3b2c0a7931b0270f1d18f1d
MD5 77816d7d0b67b8db86a44f0503350abe
SHA1 1d7aecdbc28e1ca7a6a492ae395e89f51de00a83
SHA512 5bd60e9f47b5e129cb3e627b73f74e9341c4ed36cab61da47fec5893e25b31f19ea89115ca5896af7bbe9a061fabf7d6e8833f00580ec0a1dee790e1318dbae9
SSDEEP 196608:MuIzcuEOyzBkVDc23Wo4CFmnoNdCELNvL8:IzezBIQEkoNdCSvw
TLSH
T1D4575C43F2A3D4BCD56AC4B482167232FB357C9A84367A6B17E48B313F68B505B1DB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AutoWording-v0.2.0-windows-x64.exe

File Explorer

AutoWording-v0.2.0-windows-x64.exe

.exe 26.1MB

AutoWording-v0.2.0-windows-x64.exe

IMPHASH c0c7c07ac889c8ef7b614f49d274cdcc
SHA256 f0bc6a7b6ec896c6c637d5d836499c23a1b0cb1cf3b2c0a7931b0270f1d18f1d
MD5 77816d7d0b67b8db86a44f0503350abe
SHA1 1d7aecdbc28e1ca7a6a492ae395e89f51de00a83
SHA512 5bd60e9f47b5e129cb3e627b73f74e9341c4ed36cab61da47fec5893e25b31f19ea89115ca5896af7bbe9a061fabf7d6e8833f00580ec0a1dee790e1318dbae9
SSDEEP 196608:MuIzcuEOyzBkVDc23Wo4CFmnoNdCELNvL8:IzezBIQEkoNdCSvw
TLSH
T1D4575C43F2A3D4BCD56AC4B482167232FB357C9A84367A6B17E48B313F68B505B1DB09
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualQuery __C_specific_handler AddVectoredExceptionHandler FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetUnhandledExceptionFilter CreateToolhelp32Snapshot Module32FirstW Module32NextW RtlCaptureContext RtlVirtualUnwind GetTimeZoneInformationForYear CancelIo CancelIoEx CloseThreadpoolTimer CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateThreadpoolTimer CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeLibrary GetBinaryTypeW GetCurrentPackageFullName GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetQueuedCompletionStatusEx GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultLocaleName GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsThreadAFiber LoadLibraryA LoadLibraryExA LoadLibraryExW LocaleNameToLCID MapViewOfFile MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus PowerClearRequest PowerCreateRequest PowerSetRequest ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx RtlLookupFunctionEntry SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadPriority SetThreadStackGuarantee SetThreadpoolTimer SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TrySubmitThreadpoolCallback UnmapViewOfFile VirtualProtect WaitForMultipleObjects WaitForSingleObject WriteFile WriteFileEx lstrlenW CloseHandle GetProcessHeap HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP GetStdHandle SetNamedPipeHandleState WriteConsoleW

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr acos acosf asinf atan2 atan2f cbrtf ceil ceilf cos cosf exp expf floor floorf fmod fmodf log log1pf log2 log2f logf pow powf round roundf sin sinf tan tanf tanhf truncf

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

ntdll

NtCreateNamedPipeFile RtlGetVersion RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile

gdiplus

GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipGetImageThumbnail GdiplusShutdown GdiplusStartup

bcryptprimitives

ProcessPrng

advapi32

CredDeleteW CredFree CredReadW CredWriteW RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyExW RegOpenKeyTransactedW RegQueryValueExW RegSetValueExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

combase

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemFree

comctl32

TaskDialogIndirect

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmSetWindowAttribute

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory2

gdi32

CreateDIBSection CreateSolidBrush DeleteObject

icuuc

u_strlen

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal OleInitialize OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayPutElement SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear

shell32

DragQueryFileW SHCreateItemFromParsingName SHGetDesktopFolder SHGetKnownFolderPath SHOpenFolderAndSelectItems SetCurrentProcessExplicitAppUserModelID ShellExecuteW

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

user32

AppendMenuW ClientToScreen CloseClipboard CountClipboardFormats CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EmptyClipboard EnableWindow EnumClipboardFormats EnumDisplayMonitors EnumDisplaySettingsW EnumThreadWindows FlashWindowEx GetActiveWindow GetClassNameW GetClientRect GetClipboardData GetClipboardFormatNameW GetCursorPos GetDoubleClickTime GetDpiForWindow GetFocus GetForegroundWindow GetKeyState GetKeyboardLayoutNameW GetKeyboardState GetMessageW GetMonitorInfoW GetPointerType GetProcessWindowStation GetSystemMetrics GetSystemMetricsForDpi GetUserObjectInformationW GetWindowLongPtrW GetWindowPlacement GetWindowRect IsIconic IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadImageW MapVirtualKeyW MessageBeep MessageBoxW MonitorFromPoint MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RedrawWindow RegisterClassW RegisterClipboardFormatW RegisterPowerSettingNotification RegisterSuspendResumeNotification ReleaseCapture RemovePropW ScreenToClient SendInput SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetFocus SetForegroundWindow SetMenuItemInfoW SetPropW SetTimer SetWindowLongPtrW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindowAsync SystemParametersInfoW ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnregisterPowerSettingNotification UnregisterSuspendResumeNotification ValidateRect

userenv

GetUserProfileDirectoryW

winmm

timeBeginPeriod timeEndPeriod

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

Name

.text

Size

20.3MB

Virtual Size

20.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

469KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AutoWording-v0.2.0-windows-x64.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

gdiplus

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

api-ms-win-shcore-scaling-l1-1-1

combase

comctl32

d3d11

dcomp

dwmapi

dwrite

dxgi

gdi32

icuuc

imm32

ole32

oleaut32

shell32

uiautomationcore

user32

userenv

winmm

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

crypt32

secur32

ws2_32

generic