Behavioral task
behavioral1
Sample
Woofer.exe
Resource
win7-20240903-en
General
-
Target
Woofer.exe
-
Size
229KB
-
MD5
8a2615083862de25f6d86c69304a4078
-
SHA1
4c88dbba86b4023a22700671e2116c96bd8ebb0f
-
SHA256
8cbfb916aafe951957c1c79531deaa85f3c3d71bd9afa0b42d0996c71371116f
-
SHA512
ae108ba79a2f5782aa82f90fda878ccc442f15c0938011b5d03bafb0f4c72497813b21f8bf7c4f358f232bf118946e556d2315cf52cdc91c6dd992d7bd326df4
-
SSDEEP
6144:lloZMArIkd8g+EtXHkv/iD45GEoaxfEY32mfh8ItRub8e1mfi:noZHL+EP85GEoaxfEY32mfh8It8V
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1338987638002024459/kMMxI68f8f2NXZJyfhthmhw7iaH0e0cRTEYjgULB9xl-r_958kqvH314t4TpyA7dKW12
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Woofer.exe
Files
-
Woofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ