WORKING WOOFER[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
WORKING WOOFER.rar
Size 1.0MB
Sample260825-2n211azdpb
SHA256 7b21a8d2d19a3e2db50a655abc9513fa1d93bdf8bd64187b31b0311fd78c5a99
MD5 414288e8835d5ab3934d6dfecfdc6317
SHA1 2d09ed0c76a66d8e7fd111615d3c5e31eae72bd8
SHA512 51124208a2d9fb2550068dadf9c364bc64ebb62b7d3017a678bc533c9e081ef54b5420fa75ecb867f056699bdb43dd84e33f22011387d4f272dae20af5d30e80
SSDEEP 24576:wuxSqZifMR/FjsboJod2RIopstGMH+KsPEw9Vz4JSs7GMB4/pA:rRV7JOgKErKsHop7GC
TLSH
T12A35337ADBCD583F8F1807988F93A1B297C65742865E1306B7A90F407ABDCB4DE62170
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Paste Land Temp Free/Free Temp Pasteland.exe

File Explorer

WORKING WOOFER.rar

.rar 1.0MB
Paste Land Temp Free/Free Temp Pasteland.exe

.exe 2.2MB

WORKING WOOFER.rar

SHA256 7b21a8d2d19a3e2db50a655abc9513fa1d93bdf8bd64187b31b0311fd78c5a99
MD5 414288e8835d5ab3934d6dfecfdc6317
SHA1 2d09ed0c76a66d8e7fd111615d3c5e31eae72bd8
SHA512 51124208a2d9fb2550068dadf9c364bc64ebb62b7d3017a678bc533c9e081ef54b5420fa75ecb867f056699bdb43dd84e33f22011387d4f272dae20af5d30e80
SSDEEP 24576:wuxSqZifMR/FjsboJod2RIopstGMH+KsPEw9Vz4JSs7GMB4/pA:rRV7JOgKErKsHop7GC
TLSH
T12A35337ADBCD583F8F1807988F93A1B297C65742865E1306B7A90F407ABDCB4DE62170
MD5 SHA1 SHA512 SSDEEP TLSH

Paste Land Temp Free/Free Temp Pasteland.exe

IMPHASH bf0e63e42abed8aa5fa83e12af7ecc90
SHA256 cb5cedc5f601e09bad4de1d449dfa7e4bc726ff1a9fdd41530f40673c96b7ef1
MD5 5f364b4992750d7b8d7a78472e543044
SHA1 4cbc0d4ab7ce7c5e5760f3e016d5d33e0d281c09
SHA512 9b38b60b6a4762011dcb58e45692d85f95bb728d336d71702a2bd87b6bd0d02f5a2dc01b2804fc236b52b30a2e7c1e53e7f9a0aa1d8b5700f8506193af0ddf21
SSDEEP 49152:OUdstmQWtVspnB8fbYV/VVuxK0Ervgs7:rQWtcqxq
TLSH
T136A56B56A2F9E1A6E35DC578A609A753DF20388D130863F726DCCAD43762D912B7C332
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

655968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetFileAttributesA GetTempPathA CloseHandle GetLastError WaitForSingleObject Sleep GetExitCodeProcess CreateProcessA GetModuleFileNameA GetConsoleWindow CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree DeleteFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA QueryPerformanceCounter QueryPerformanceFrequency LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateDirectoryA FreeLibrary WideCharToMultiByte GetProcAddress LoadLibraryA MultiByteToWideChar GetLocaleInfoA GlobalAlloc GlobalUnlock GlobalLock GlobalFree

user32

GetKeyState TrackMouseEvent GetCapture GetKeyboardLayout ReleaseCapture IsWindowUnicode GetForegroundWindow GetMessageExtraInfo SetCapture SetCursorPos GetWindowRect UpdateWindow SetWindowPos ShowWindow DestroyWindow UnregisterClassA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage MessageBoxA PostMessageA CreateWindowExA RegisterClassA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor GetClientRect

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyA RegCloseKey RegSetValueExA RegEnumKeyExA

shell32

ShellExecuteExA ShellExecuteA

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

iphlpapi

GetAdaptersInfo

vcruntime140

memchr memcmp memmove strstr __std_terminate memset __std_exception_copy __std_exception_destroy _CxxThrowException strrchr longjmp __C_specific_handler __intrinsic_setjmp __current_exception __current_exception_context memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcpy_s strlen strcmp strncpy strncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush ungetc setvbuf _fseeki64 fsetpos __stdio_common_vsprintf fwrite __stdio_common_vsprintf_s fgetpos ftell fgetc _get_stream_buffer_pointers fclose _wfopen __acrt_iob_func _set_fmode fputc __stdio_common_vfprintf fseek fread __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

cosf fabs sqrtf fmodf sinf acosf ceilf __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _c_exit _cexit _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _beginthreadex _register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale