WooferLoader (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WooferLoader (1).exe
Size 45.6MB
Sample260809-xncznack6t
SHA256 411babaa107175e6ca8615536558fe661beb52442857c374f9f9711da0904798
MD5 26a9fff801a93bfc899107ad09dc9361
SHA1 45ca263dde07a2e04604d5b264002df7c79f3fa2
SHA512 f4575c93da09d33763f1875aec92876761bf46e139467ad6f38e179f3675a54824abc0bcb19f5bac416c12f778e458ef3ceb41df1c42f89c418e9b99f5eaea52
SSDEEP 786432:wN+zbRMNSWqK/ulg6KhG+KAdoObXbeIzOPi:w8zVM9/ulgVXxSO3eIz
TLSH
T145A723DF95E5A2E8D8C3064856CE12C751C1A4BAC9DA4A2C29CB6C037830E7FD9CD577
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WooferLoader (1).exe

File Explorer

WooferLoader (1).exe

.exe 45.6MB

WooferLoader (1).exe

IMPHASH 603a2e573517ce66e4fa4f6800bdce70
SHA256 411babaa107175e6ca8615536558fe661beb52442857c374f9f9711da0904798
MD5 26a9fff801a93bfc899107ad09dc9361
SHA1 45ca263dde07a2e04604d5b264002df7c79f3fa2
SHA512 f4575c93da09d33763f1875aec92876761bf46e139467ad6f38e179f3675a54824abc0bcb19f5bac416c12f778e458ef3ceb41df1c42f89c418e9b99f5eaea52
SSDEEP 786432:wN+zbRMNSWqK/ulg6KhG+KAdoObXbeIzOPi:w8zVM9/ulgVXxSO3eIz
TLSH
T145A723DF95E5A2E8D8C3064856CE12C751C1A4BAC9DA4A2C29CB6C037830E7FD9CD577
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64955257

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

ntdll

RtlVirtualUnwind RtlPcToFileHeader RtlUnwind RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext

kernel32

GetProcessHeap HeapFree HeapReAlloc HeapAlloc ReadFile GetFileSizeEx FreeLibrary SetEndOfFile WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetTimeZoneInformation SetStdHandle CreateProcessW GetExitCodeProcess QueryPerformanceFrequency GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetConsoleOutputCP FlushFileBuffers GetCommandLineW GetCommandLineA GetModuleFileNameW MapViewOfFile SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread LoadLibraryA GetLocaleInfoA GlobalFree MultiByteToWideChar GlobalUnlock QueryPerformanceCounter CreateDirectoryA GetSystemTimeAsFileTime CreateProcessA GetCurrentProcessId LocalFree GlobalLock GlobalAlloc DeleteFileA GetLastError GetTickCount64 Sleep GetCurrentThreadId WaitForSingleObject ExpandEnvironmentStringsA OutputDebugStringA WriteFile GetCurrentProcess GetConsoleWindow WideCharToMultiByte GetModuleHandleW GetProcAddress CloseHandle ExitThread CreateThread ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount UnmapViewOfFile FileTimeToSystemTime CreateFileMappingA InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CreateFileA VirtualAlloc DeviceIoControl GetSystemFirmwareTable EnumSystemLocalesW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx WakeAllConditionVariable SleepConditionVariableSRW RaiseException GetTickCount VirtualFree VirtualLock VirtualUnlock GetModuleHandleExW SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect GetEnvironmentVariableW SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA FormatMessageA GetStdHandle GetFileType InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP ConvertFiberToThread ConvertThreadToFiberEx GetSystemTime SystemTimeToFileTime LoadLibraryW FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetStringTypeW IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

crypt32

CertFreeCertificateContext CryptEncodeObjectEx CertOpenStore CertCloseStore CryptProtectData CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CertEnumCertificatesInStore

ws2_32

gethostbyaddr sendto recvfrom getpeername shutdown listen bind closesocket connect ioctlsocket getsockopt select setsockopt socket WSAStartup WSACleanup accept freeaddrinfo getaddrinfo WSAGetLastError recv send WSASetLastError getsockname ntohs gethostbyname htonl htons inet_addr inet_ntoa getservbyname getservbyport WSASocketA

user32

ShowWindow TranslateMessage PostQuitMessage SetProcessDPIAware UpdateWindow GetProcessWindowStation GetUserObjectInformationW PeekMessageW RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW SetWindowRgn SetWindowPos DestroyWindow GetWindowRect DispatchMessageW MessageBoxW EmptyClipboard DefWindowProcW CloseClipboard SetLayeredWindowAttributes MessageBoxA SetClipboardData OpenClipboard GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetClipboardData

gdi32

CreateRoundRectRgn

advapi32

CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptGetProvParam CryptGetUserKey CryptEnumProvidersW CryptSignHashW CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptDestroyKey CreateServiceA RegDeleteTreeA RegCloseKey ConvertSidToStringSidA CloseServiceHandle RegQueryValueExA OpenSCManagerW OpenSCManagerA RegCreateKeyExA DeleteService ControlService StartServiceA RegSetValueExW RegSetValueExA OpenProcessToken RegOpenKeyExA RegOpenKeyExW RegDeleteValueA RegQueryValueExW RegEnumKeyExA OpenServiceA GetTokenInformation GetUserNameW CryptReleaseContext CryptAcquireContextW CryptSetHashParam

shell32

SHGetFolderPathW ShellExecuteW

iphlpapi

GetIpNetTable GetAdaptersInfo

shlwapi

StrStrIA

bcrypt

BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiSetClassInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCallClassInstaller

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryOption

Name

.text

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.enc

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Wf10

Size

Virtual Size

25.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Wf11

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Wf12

Size

45.6MB

Virtual Size

45.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WooferLoader (1).exe

d3d11

d3dx11_43

d3dcompiler_43

ntdll

kernel32

crypt32

ws2_32

user32

gdi32

advapi32

shell32

iphlpapi

shlwapi

bcrypt

setupapi

imm32

dwmapi

winhttp

generic