Static task
static1
Behavioral task
behavioral1
Sample
WillowTree#.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WillowTree#.exe
Resource
win10v2004-20231215-en
General
-
Target
WillowTree#.exe
-
Size
701KB
-
MD5
9faab07ffbca8d646ec414a99d31493a
-
SHA1
57658e147247a3a80e49649f1696fd5073eccb50
-
SHA256
8f2c7b8eb5d68c4607a64fe102b7bfb079dffd4be7c1108ef8eb59842aec903f
-
SHA512
31d9ce35e8bca113e6bbf2ca15dd5b1a5aabee1b42a101ab73b69db95ca554fc04635136e4dc2e4ece279ff20731ad6102be15d98f27bfe508acc97c62cb16ac
-
SSDEEP
6144:WWqqVH183iusLxxi5I8NQKxAb/+Zb71wSp3gE21kSvZNyOkSvZfCKCvCyhCNJSkS:7VH+3iFYHQyn1/wHbyT10NJSK9yZU/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WillowTree#.exe
Files
-
WillowTree#.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 673KB - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ