General

  • Target
    wzsus53.exe
  • Size 46.1MB
  • Sample261113-k48eaasy3m
  • SHA256 ea4978b4261cccc53702fd3c2cffc44e8e83aa1958874e57d7c89a6c8a5e56fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • wzsus53.exe
    .exe 46.1MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 15KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/ioSpecial.ini
    928B
  • $PLUGINSDIR/linker.dll
    .dll 7KB
  • $PLUGINSDIR/modern-wizard.bmp
    340KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 7KB
  • SystemInfo-vc141-mt.dll
    .dll 2.4MB
  • SystemInfo-vc141-mt.mab
    1003KB

wzsus53.exe

  • IMPHASH b729b61eb1515fcf7b3e511e4e66258b
  • SHA256 ea4978b4261cccc53702fd3c2cffc44e8e83aa1958874e57d7c89a6c8a5e56fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3a:e7:44:5b:f0:ee:1e:c7:95:46:15:d2:26:7c:0e:9b:5a:62:8d:bd:c7:06:dc:b4:d0:ea:3a:cc:0b:a7:7c:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=BC1214880,CN=COREL CORPORATION,O=COREL CORPORATION,L=Ottawa,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341
Minor OS version
0
Major OS version
5
Entry point
13643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths