General

  • Target

    woodworm2.rar

  • Size

    1.3MB

  • MD5

    f536b52db492b1fdb8e63835ccadc19a

  • SHA1

    f78b0ea82c066384989b8a1b2d0d18b9b3a7467c

  • SHA256

    9fe7290683da9970955808375b203340812ada3a63930bc2db88ecb956842d0f

  • SHA512

    d67f26724d6355a7077c92e90213abbdb208ba1703aa24472d99424a9120195a84e2577b33c460ddb9f6a8df36bfea4e13bbfd3bf10d1cb28ff2aade427720ac

  • SSDEEP

    24576:6gj/9MHOOG3BshTXQVg3Sx5AyiPjfVVy703Lb4p86hi8gU02Cqm3SPnkbwx7eH/E:L/6jqs1XQVg3Sx5AyiPjfVVy70bb4pZ1

Score
3/10

Malware Config

Signatures

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • woodworm2.rar
    .rar

    Password: infected

  • wworm2/ApplicationUnit.pas
  • wworm2/AzureusSeeder.pas
  • wworm2/BOT.pas
  • wworm2/DOCS.doc
    .rtf .doc
  • wworm2/MsnSpread.pas
  • wworm2/SocketUnit.pas
  • wworm2/StrList.pas
  • wworm2/ThreadProcs.pas
  • wworm2/ThreadUnit.pas
  • wworm2/Units/.DS_Store
  • wworm2/Units/._.DS_Store
  • wworm2/Units/ApplicationUnit.pas
  • wworm2/Units/AzureusSeeder.pas
  • wworm2/Units/BOT.pas
  • wworm2/Units/MSNapi/DispImpl_TLB.dcr
  • wworm2/Units/MSNapi/DispImpl_TLB.pas
  • wworm2/Units/MSNapi/MessengerAPI.bpi
  • wworm2/Units/MSNapi/MessengerAPI.bpl
    .dll windows x86

    Password: infected


    Headers

    Exports

    Sections

  • wworm2/Units/MSNapi/MessengerAPI.cfg
  • wworm2/Units/MSNapi/MessengerAPI.dcp
  • wworm2/Units/MSNapi/MessengerAPI.dof
  • wworm2/Units/MSNapi/MessengerAPI.dpk
  • wworm2/Units/MSNapi/MessengerAPI.hpp
  • wworm2/Units/MSNapi/MessengerAPI.lsp
  • wworm2/Units/MSNapi/MessengerAPI.res
  • wworm2/Units/MSNapi/MessengerAPI_TLB.dcr
  • wworm2/Units/MSNapi/MessengerAPI_TLB.pas
  • wworm2/Units/MSNapi/MessengerContentInstallerLibrary_TLB.dcr
  • wworm2/Units/MSNapi/MessengerContentInstallerLibrary_TLB.pas
  • wworm2/Units/MSNapi/MessengerPrivate_TLB.dcr
  • wworm2/Units/MSNapi/MessengerPrivate_TLB.pas
  • wworm2/Units/MSNapi/MsgrConversationWndPlugin_TLB.dcr
  • wworm2/Units/MSNapi/MsgrConversationWndPlugin_TLB.pas
  • wworm2/Units/MSNapi/P4PLib_TLB.dcr
  • wworm2/Units/MSNapi/P4PLib_TLB.pas
  • wworm2/Units/MSNapi/P4QuickLaunchLibrary_TLB.dcr
  • wworm2/Units/MSNapi/P4QuickLaunchLibrary_TLB.pas
  • wworm2/Units/MSNapi/Pas/DispImpl_TLB.dcr
  • wworm2/Units/MSNapi/Pas/DispImpl_TLB.dcu
  • wworm2/Units/MSNapi/Pas/DispImpl_TLB.pas
  • wworm2/Units/MSNapi/Pas/MessengerAPI_TLB.dcr
  • wworm2/Units/MSNapi/Pas/MessengerAPI_TLB.dcu
  • wworm2/Units/MSNapi/Pas/MessengerAPI_TLB.pas
  • wworm2/Units/MSNapi/Pas/MessengerAPI_TLB.~pas
  • wworm2/Units/MSNapi/Pas/MessengerContentInstallerLibrary_TLB.dcr
  • wworm2/Units/MSNapi/Pas/MessengerContentInstallerLibrary_TLB.dcu
  • wworm2/Units/MSNapi/Pas/MessengerContentInstallerLibrary_TLB.pas
  • wworm2/Units/MSNapi/Pas/MessengerPrivate_TLB.dcr
  • wworm2/Units/MSNapi/Pas/MessengerPrivate_TLB.dcu
  • wworm2/Units/MSNapi/Pas/MessengerPrivate_TLB.pas
  • wworm2/Units/MSNapi/Pas/MsgrConversationWndPlugin_TLB.dcr
  • wworm2/Units/MSNapi/Pas/MsgrConversationWndPlugin_TLB.dcu
  • wworm2/Units/MSNapi/Pas/MsgrConversationWndPlugin_TLB.pas
  • wworm2/Units/MSNapi/Pas/P4PLib_TLB.dcr
  • wworm2/Units/MSNapi/Pas/P4PLib_TLB.dcu
  • wworm2/Units/MSNapi/Pas/P4PLib_TLB.pas
  • wworm2/Units/MSNapi/Pas/P4QuickLaunchLibrary_TLB.dcr
  • wworm2/Units/MSNapi/Pas/P4QuickLaunchLibrary_TLB.dcu
  • wworm2/Units/MSNapi/Pas/P4QuickLaunchLibrary_TLB.pas
  • wworm2/Units/MSNapi/TYPELIB_1.tlb
  • wworm2/Units/MSNapi/TYPELIB_2.tlb
  • wworm2/Units/MSNapi/TYPELIB_3.tlb
  • wworm2/Units/MSNapi/TYPELIB_4.tlb
  • wworm2/Units/MSNapi/TYPELIB_5.tlb
  • wworm2/Units/MSNapi/TYPELIB_6.tlb
  • wworm2/Units/MSNapi/TYPELIB_7.tlb
  • wworm2/Units/MSNapi/msn_type_lib1.ocx
  • wworm2/Units/MSNapi/msn_type_lib2.ocx
  • wworm2/Units/MSNapi/msn_type_lib3.ocx
  • wworm2/Units/MSNapi/msn_type_lib4.ocx
  • wworm2/Units/MSNapi/msn_type_lib5.ocx
  • wworm2/Units/MSNapi/msn_type_lib6.ocx
  • wworm2/Units/MSNapi/msn_type_lib7.ocx
  • wworm2/Units/MSNapi/readme.txt
  • wworm2/Units/MsnSpread.pas
  • wworm2/Units/Neuer Ordner/KOL.dcu
  • wworm2/Units/Neuer Ordner/KOL.obj
  • wworm2/Units/Neuer Ordner/KOLDEF.INC
  • wworm2/Units/Neuer Ordner/KOLSocket.dcu
  • wworm2/Units/Neuer Ordner/KOLSocket.pas
    .js
  • wworm2/Units/Neuer Ordner/KOL_ASM.inc
  • wworm2/Units/Neuer Ordner/LICENSE.txt
  • wworm2/Units/Neuer Ordner/MCKfakeClasses.inc
  • wworm2/Units/Neuer Ordner/delphicommctrl.inc
  • wworm2/Units/Neuer Ordner/delphidef.inc
  • wworm2/Units/Neuer Ordner/delphiusesh.inc
  • wworm2/Units/Neuer Ordner/kol.pas
    .js
  • wworm2/Units/Neuer Ordner/mckSocket.dcr
  • wworm2/Units/Neuer Ordner/mckSocket.pas
  • wworm2/Units/Neuer Ordner/objects.dcu
  • wworm2/Units/Neuer Ordner/objects.pas
  • wworm2/Units/Neuer Ordner/read1st.txt
  • wworm2/Units/Neuer Ordner/read1st_rus.txt
  • wworm2/Units/Neuer Ordner/visual_xp_styles.inc
  • wworm2/Units/SocketUnit.pas
  • wworm2/Units/StrList.pas
  • wworm2/Units/ThreadProcs.pas
  • wworm2/Units/ThreadUnit.pas
  • wworm2/Units/Winsock2.pas
    .js
  • wworm2/Units/functions.pas
  • wworm2/Units/p2pspread.pas
  • wworm2/Units/polyengine.pas
    .js
  • wworm2/Units/strings.pas
  • wworm2/Units/uTorrentSeeder.pas
    .js
  • wworm2/Winsock2.pas
    .js
  • wworm2/WoodWorm.cfg
  • wworm2/WoodWorm.dof
  • wworm2/WoodWorm.dpr
  • wworm2/cleanup.bat
  • wworm2/functions.pas
  • wworm2/makebuild.bat
  • wworm2/p2pspread.pas
  • wworm2/polyengine.pas
    .vbs
  • wworm2/smallcfg/.DS_Store
  • wworm2/smallcfg/._.DS_Store
  • wworm2/smallcfg/Project1.cfg
  • wworm2/smallcfg/Project1.dof
  • wworm2/smallcfg/Project1.dpr
  • wworm2/smallcfg/Project1.dproj
  • wworm2/smallcfg/Project1.dproj.local
  • wworm2/smallcfg/Project1.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • wworm2/smallcfg/Project1.identcache
  • wworm2/smallcfg/Project1.res
  • wworm2/smallcfg/Project1.~dpr
  • wworm2/smallcfg/Unit1.dcu
  • wworm2/smallcfg/Unit1.ddp
  • wworm2/smallcfg/Unit1.dfm
  • wworm2/smallcfg/Unit1.pas
  • wworm2/smallcfg/Unit1.~ddp
  • wworm2/smallcfg/Unit1.~dfm
  • wworm2/smallcfg/Unit1.~pas
  • wworm2/smallcfg/file.txt
  • wworm2/smallcfg/polyengine.dcu
  • wworm2/smallcfg/polyengine.pas
    .js
  • wworm2/smallcfg/polyengine.~pas
    .js
  • wworm2/strings.pas
  • wworm2/utorrentseeder.pas
    .js