BraskoPaidWoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BraskoPaidWoofer.exe
Size

2.0MB
MD5

71e7655f8bb1f772301a079fd39767c4
SHA1

4c194faf828192c611932551a47490b350450f32
SHA256

4a45f28f7e1312986ba070688f8aee09177ada6cbd6f040292df8863453793fd
SHA512

1905e17d6e576ffaa093fc692b3169353f8cabdea405b71e9a0dd727b4784c78e03e0d1d3656e0e4583269a76b7b15a7a0f80ec7eaaecd2f57220ce6f3cf3936
SSDEEP

49152:736LZO6fdZh9c/oLp7VkAI2GrhCWc4yWEBf2:uNO6ffB/kVjFCtU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BraskoPaidWoofer.exe

Files

BraskoPaidWoofer.exe
.exe windows x64

5996ae9183ac396df5e0551936abdd78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

ShellAboutA

user32

EndPaint

advapi32

RegOpenKeyExW

kernel32

GetModuleHandleA

Sections

.data
Size: - Virtual size: 586KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE