?DriverEntry@@YAJPEAU_DRIVER_OBJECT@@PEAU_UNICODE_STRING@@@Z
Overview
overview
8Static
static
3UDWoof 2.1...01.zip
windows7-x64
1UDWoof 2.1...01.zip
windows10-2004-x64
1UDWoof 2.1...s).bat
windows7-x64
8UDWoof 2.1...s).bat
windows10-2004-x64
8UDWoof 2.1...E).txt
windows7-x64
1UDWoof 2.1...E).txt
windows10-2004-x64
1UDWoof 2.1...er.exe
windows7-x64
UDWoof 2.1...er.exe
windows10-2004-x64
Static task
static1
Behavioral task
behavioral1
Sample
UDWoof 2.1.1-20230605T162318Z-001.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UDWoof 2.1.1-20230605T162318Z-001.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
UDWoof 2.1.1/DeepClean (dels some files).bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
UDWoof 2.1.1/DeepClean (dels some files).bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
UDWoof 2.1.1/TUTORIAL (README).txt
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
UDWoof 2.1.1/TUTORIAL (README).txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
UDWoof 2.1.1/hwid_spoofer.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
UDWoof 2.1.1/hwid_spoofer.exe
Resource
win10v2004-20230220-en
General
-
Target
UDWoof 2.1.1-20230605T162318Z-001.zip
-
Size
88KB
-
MD5
0dbbe3be64fc1cf98ee907ef8d2e72b9
-
SHA1
f3e598cc0e0253f7e0172a3ac5f049c0fb2cc4b7
-
SHA256
ab5ac412a81f55e6fa6b35db8ab575a0171985c1f24cafae597947bc9fee8374
-
SHA512
652a44b357caa93891f5e117fa2e80d4ea2ffa8cea559119cbd367f14eefbc345800310c257b7012acd5e101af9a43f61fc767646f80c586d6e641127aed5bc3
-
SSDEEP
1536:+A4dgOMHbzodUG0SSQaHXZvxvQUsnRz4QeAIapPwu/N43xdxDumWaQuPe1kzQ86B:+AkgFIdU6SQk34UsnRzzx5GhO08dyph4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/UDWoof 2.1.1/hwid_spoofer.sys
Files
-
UDWoof 2.1.1-20230605T162318Z-001.zip.zip
-
UDWoof 2.1.1/DeepClean (dels some files).bat
-
UDWoof 2.1.1/TUTORIAL (README).txt
-
UDWoof 2.1.1/hwid_spoofer.sys.exe windows x64
13dd23e359f56e71143c1727fd0895de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
RtlInitString
RtlInitUnicodeString
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
IoGetDeviceObjectPointer
ObfDereferenceObject
IoEnumerateDeviceObjectList
_vsnwprintf
ObReferenceObjectByName
strlen
vDbgPrintExWithPrefix
RtlRandomEx
MmMapIoSpace
MmUnmapIoSpace
isupper
islower
isdigit
strstr
KeQueryTimeIncrement
ZwQuerySystemInformation
IoDriverObjectType
strcpy
hal
KeQueryPerformanceCounter
Exports
Exports
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE