goldenwoolf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
goldenwoolf.exe
Size 322KB
Sample260802-hf4p3sem6x
SHA256 632b2ea02a89c9d6357a22b418037a5f710cbf6152e74b35aa59cc6ff1190d6f
MD5 efbc28c76d321cc00b831262e5c48b78
SHA1 9d7c752cf0ab14d861bba2101ff5426d1fdd0830
SHA512 2ab89edffb5a224f8a4331e5fb98e785f76bae080ac467184ebad6908f9ca1c72f10244c2a6e3ff06298e09c4a3cdad4c71aba6f22fa6bed60f1df716ac173f2
SSDEEP 6144:DElt0MBVnyrflzY8OtPP7qbhxhfJXNmqnB:DElOwVn+0rn7qbhxhFB
TLSH
T16A648E19F7A414F9E1778279CD524906E7727C5607B0EB8F23A04A963F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
goldenwoolf.exe

File Explorer

goldenwoolf.exe

.exe 322KB

goldenwoolf.exe

IMPHASH 1bd04fd90bf17bdc54e594303a15ab99
SHA256 632b2ea02a89c9d6357a22b418037a5f710cbf6152e74b35aa59cc6ff1190d6f
MD5 efbc28c76d321cc00b831262e5c48b78
SHA1 9d7c752cf0ab14d861bba2101ff5426d1fdd0830
SHA512 2ab89edffb5a224f8a4331e5fb98e785f76bae080ac467184ebad6908f9ca1c72f10244c2a6e3ff06298e09c4a3cdad4c71aba6f22fa6bed60f1df716ac173f2
SSDEEP 6144:DElt0MBVnyrflzY8OtPP7qbhxhfJXNmqnB:DElOwVn+0rn7qbhxhFB
TLSH
T16A648E19F7A414F9E1778279CD524906E7727C5607B0EB8F23A04A963F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow SetWindowPos GetDlgItem SendMessageW TranslateMessage DefWindowProcW SetTimer KillTimer GetSystemMetrics UpdateWindow SetForegroundWindow GetMessageW LoadCursorA FillRect MessageBeep MessageBoxW GetClientRect GetWindowTextW SetWindowTextW EndPaint BeginPaint

gdi32

CreatePen CreateFontW CreateSolidBrush SetTextColor SetBkMode SetBkColor SelectObject RoundRect GetStockObject DeleteObject

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA

shell32

ShellExecuteW SHGetFolderPathW

advapi32

RegDeleteValueW RegCreateKeyExW RegOpenKeyExW CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA RegSetValueExW RegQueryValueExW RegCloseKey

ws2_32

htons connect closesocket recv send setsockopt socket WSAStartup WSACleanup inet_addr

iphlpapi

GetAdaptersInfo

mpr

WNetCancelConnection2A WNetAddConnection2A

netapi32

NetShareEnum NetApiBufferFree

kernel32

GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx HeapReAlloc FindFirstFileExW IsValidCodePage IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize SetEndOfFile ReadConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject HeapFree HeapAlloc WriteConsoleW LeaveCriticalSection ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW GetFileSize GetLogicalDrives ReadFile SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError CreateMutexW OpenMutexW Sleep CreateProcessA GetTickCount GetModuleFileNameW GetModuleHandleW WinExec CopyFileW GetComputerNameA WideCharToMultiByte WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetProcAddress GetStringTypeW GetCPInfo GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess ExitThread RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread

Name

.text

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

goldenwoolf.exe

user32

gdi32

wininet

shell32

advapi32

ws2_32

iphlpapi

mpr

netapi32

kernel32

generic