Retrack Woofer[.]exe | Triage

Sharing

General

Target

Retrack Woofer.exe
Size

804KB
MD5

ae3f1e9ec89b546f4542ab3b3df5f593
SHA1

578044dc221016ef0a09fef215f731170fbfe6cd
SHA256

8af4c53b8010c14e5a07c9f72ec0172588ef13d7aa04afa1332666732d95cb0f
SHA512

57ff387cd6a66e5fe312b0ce383f5423625d20e0f9d1ecdf78e52c729ff9d73feaaec4751450f152be313793fe8dc3d4c656be802e0f8f876d36e65564eeb2b3
SSDEEP

24576:06mTXNe2tyyucITeGvlC6g9joXzFqeECi:lmhrClF9DzzF8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Retrack Woofer.exe

Files

Retrack Woofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 802KB - Virtual size: 801KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ