TU~�=2D� ����������`tb�t�T� ��K��CW8�D;��6EU '(�;�a�t�,:���<F��e���h����-� ~�/�_F����x���(�w^���-|�c�BA���tH�W�(�����AFPz��/�7$g\a7 7`�;����V��K�Pta\�[��[{�U�47�)��/B�+�Xф ;J;���%/`{�/VZ�$~AG�!&�����k@u��erI�n�3{Z�N���dA�0�@H!��3-�1�������ľ�wh��<�G���� �O$R� �Cdj��^q��D��q���W�� ��S���H�g[��#Rr ε[���JK�e�F[����o��>�d�Pk)]���vT�y���I��G��tj���;��_0 Ę���>����L,�X��o�=]ΪX����Y��?ہ�x٭�c�Uy[�����8�}�G��#Z�)cI�,s� ��oFor�� ������Z��_�mq�.0s�T���q?���L�/�ܐ��� ����P��YʮiLV�|x3�/���<�Xr��,��X�u�;��m 3�#��4����@�8�|��*E,������g��D�0PxY�l��/�����B��B焛�Σ�o���"�%n��J�b�����]��Jv�d|����I2�*�c�U���$)���c��r�:�Յ��$�!�YV��2a�m�}���rUV�`���j@�V{��f(��v2Q�O��d��p(8o0�����ɏ�������Ӟ|T+-���YV�`�od�vC]�e|���/���ǏS���X]�6/ҙ�GG��,��)��?�o7g�6��.l������ F�����f6����db������A���[W�+r[�W�"�2\���q`��)pIdUs�x�]b&?�@'/�%_�u̪u|?��������r��FE�rO�3���=fn��R�:� a#��(M2�*�*��9����|j��ߓ/vɮ"g`P����@ 4y���#��`�e�vF�a�� �nC�����&� x� �w�b�f���o5��BS����%>K$>�ގ �d"�J�!��:�X�ľ+R��\쉱� G�U�F�:d���1с\��#�ٟ�*���mxS�r �E�\ �F��ڃG�6������tɵ'��f��� �Ke,_�Όl��n2o'��<�M�k ����)�2�(���l�����0��}���n2�*�'�V���cKr�2$�t���4����5��-���2O�]�2wƠ�� �h]��W<�ǂ��Ϊ�V���:j�g�(M_��1u�&�f>�1 n�����1��B���������T�����q>�:�T e��]�.�G�c���q?EpF_���}�=Ӛ��%���фw���`���2��Qr��bN��%�k��b��ܿ�6�o����pr������,�߄�e&'�����������h�+�B���W���8�|�&M���֙O">�Ҟ~�� ��쯌��g�Nq����6 QW��!�l��|w�H���+�84�6�&@P��>��m`�,��"+B���HY����Q��=�J�j�jsSVn}ay���H�����ы�R T%�.*�"���t����O�a�_��|j���ic�$~��kP��~ko��r���"W�ȁQ{?���A���#9����ݠZ������ɓ�W?���ʄ���w*�s��B�&��2I�eT�p;�����7Y���Z�7�����@���vY��V��3�����c��yD�����xm�DP4B9Ƌ�Bz��U֫�r��XC�k���<7����"���-Z 4�{��^%W���l5�����H��9��t��B)1���ە~������-�=�� .X��k��s��o}�hK���(U����EQ�4���D72���hZw�`��z��m�� i5܇���-��OS]�ٝۮЏ4���( !�߳i��Jptˋ~H�ӔL��\Z��E1�o�"%��N7��@�v���K �NG +*h90uC���BOH&�(��I�+(�������ǝT��IE�@RE���oy%rNwb�߱gXU��� i�Y�(Z��q��H�#�4V��ɓ��;z�W�����;�#"����D��e�� %�i1< �a%�di����S������/��O��)�Y�N|�֞H?�Ej��N��m ȕ)��4*,��m�N��tHC�Lx9������ W�[˺ ���!��EX�����f��baE4Q�ɼK f8��6�<�4Cѻ�g��Co���̔j��2)�R<>�ኂf;o��(�������}'b�i�}L�]a��n/�I!z���2L��x�B!{�:�'*Vd� B������wB��+�X���i,�,"'M̄Ve.$v�}�[�4��d�{=�� ���81H�xҋ�x� ^�P��Z���3���v� ?�W��/J��,��z�5k�,�rF� �����F�!�u5ƀ߳� ^���%��{ʛ�j��qU��@��,0g�ł��s�"O}T��b߃�nj��a�9٬i��x��#��F���P9��!`�$��kE�}��?�e*�]<��B���m "����]�4�5>n���� Qa���Б�l��� ��M�0�k�ԟV9۷��Ⱥ���G�^�2��?���<ګ�/M��M��!�����P�<߱�N�#����aS@+tmfg�Z�����vC�@�u�kbr�x�S��+���Y�d�.��!�`!���w{.M���BH_��o<,#�A��ЇIesV#,�!�X��d=�fx�Ѣ�ҊUy,i���fpΗ74��fx�6���ʫAK��9�����l �-m��"X�#p ���}����h�#<r5x� �'�x���zw� ,�����=�\�������52��6��x�f�bu�����T��g#g�eAђO+��%�͉Z�:^�h�n�����1[�ih�*�d#&a����ZC��h����H����P�Rչ=�ƪ�������D��� QK��d��(-���x(��܍ޯ��O�a�{ ���(�����d�
Behavioral task
behavioral1
Sample
BW-Woofer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BW-Woofer.exe
Resource
win10-20230220-en
General
-
Target
BW-Woofer.exe
-
Size
5.3MB
-
MD5
48199d14ff914636e5c259b4ff3484a4
-
SHA1
e56fd43f4c93540f527f820774785cdeb32444b8
-
SHA256
019592090d1fcde83ba685ce9d77a93bc7989b5f1640162fbab49982658588fd
-
SHA512
608420f1595d78b9165f153255d6db8cd4f32586073ae720075462eb8bb31b02479a7ae3d116c8f2878514b4737ae37196962541056921a2444b0836db1051b3
-
SSDEEP
98304:ZXILHFA7TKP2VsVUDukHpnWz3wzT3Ef0+FXQrXCr:ZXIL+laUDrpnWz3wUf0+Fgm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BW-Woofer.exe
Files
-
BW-Woofer.exe.exe windows x64
468355acb2bd6cb2a5d280e24f7c3688
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleScreenBufferInfo
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ