General
-
Target
Woofer_-_Hwid.exe
-
Size
5.5MB
-
MD5
44c3f668cf002c241a9121b72139b42d
-
SHA1
0356cce54d3711191e32b150cfbc1367c335af01
-
SHA256
e6e800ea66bfe325aa61ab5c06b60dbce4a7d109c3f6d8f8a62cb693166e3763
-
SHA512
ef2e4759e2a098a711b3a682266029311b1bb6fd460ecec46fa234ddbc661ecc25c1f486e40cbeaaac6e5ed7af092fe8fbe8a6eb431c8e2866425cb7ffc6086f
-
SSDEEP
98304:Fb2rcboUGIj6JWBEQCNy5UuI4EPGEbHDoQb0IoB95uxiPhbQGWqCAv:/boUGzmwNya4B4MQb9owAVWr2
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Woofer_-_Hwid.exe
Files
-
Woofer_-_Hwid.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 660B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ