Static task
static1
Behavioral task
behavioral1
Sample
Pollens_Woofer.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Pollens_Woofer.exe
Resource
win10v2004-20230703-en
General
-
Target
Pollens_Woofer.exe
-
Size
303KB
-
MD5
1578886433891ef2dd05421101dee8a5
-
SHA1
6ec57e5e686091e06db51780e1773c350556e059
-
SHA256
da5c65be4478fc5b52b27172058ca59eccfe3bf5cd5f79f155f828a260eaec5b
-
SHA512
ab46aaa68443b150e4272437cb8920d8cc7842e3fbd979bf16008717107a9b5fd70c7c8b3ebf394d70cd1013dec056ac198224d4a1291a34a1893d30400554f4
-
SSDEEP
6144:+qrMI6UzXrEftQHwg7y6LOz4oTiz1iDUHgfV+95a6Wl67J:5rMIBL4ftQQgm6LO541qUAd+Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Pollens_Woofer.exe
Files
-
Pollens_Woofer.exe.exe windows x64
6e3811578f8c0a2ac800069c3a18ba98
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
kernel32
GetTempPathA
GetLastError
LoadLibraryA
GetVersionExA
CloseHandle
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
GetConsoleScreenBufferInfo
GetStdHandle
WaitForSingleObject
Sleep
GetConsoleWindow
SetConsoleCursorPosition
GetExitCodeProcess
CreateFileW
InitializeCriticalSectionEx
VirtualAlloc
DeviceIoControl
VirtualFree
GetLocaleInfoEx
FormatMessageA
SetConsoleTitleA
LocalFree
InitializeSListHead
AreFileApisANSI
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetModuleHandleW
user32
MoveWindow
GetWindowRect
SetWindowPos
GetAsyncKeyState
GetSystemMetrics
advapi32
RegCreateKeyExW
EnumServicesStatusA
CreateServiceA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
OpenServiceA
shell32
ShellExecuteExA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
ntdll
NtQuerySystemInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__current_exception
__current_exception_context
_CxxThrowException
memmove
__std_exception_destroy
memcpy
__std_exception_copy
__std_terminate
__C_specific_handler
strstr
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
remove
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_get_initial_narrow_environment
_initterm_e
exit
_set_app_type
_seh_filter_exe
_cexit
__p___argc
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
__p___argv
_exit
terminate
_crt_atexit
system
_invalid_parameter_noinfo_noreturn
_c_exit
api-ms-win-crt-stdio-l1-1-0
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_get_stream_buffer_pointers
__p__commode
fgetc
fclose
fflush
fputc
__stdio_common_vsprintf_s
_fseeki64
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ