�~�*��(j�cR�Y�7a͜� ��C.�!�U����b� ����͒�s! 3șv �Nb���tԐ;ᓹi�͂�H�`¼b��^y ��@[�m��������9���+�*�N{fy���q��偤�����Un^��;��B�qkH�0*��.j%�� �8C.�~�a�^��+�d�Έ�k� ��F�`��4d��T^q�N6zV�8(Q���5�OvR�=�dD@�i��/nz�Z���HW$���h�.��ٵ�X��<_-3�;����i��_���k�;.b�xy�o1�~��FZ5��~`��q��3�����ܔ3e�o]����H���|���[z3 בc�m��=�Âq�?�G,��w� �+�u���5��ՓU��?XlI�,��%��c�h\a8ǻ.0�Z�b�N���l��7)t��Dl�d;�_C�6�� �V#�k��ʧ�\G��Cz �e!��g��=��c�=,!�S�L��rM���=U%�������IE�;އ5�?n�4���q�������}�G�����7��Of+a�:���"�=j��7�P��b�g��j3%{����?9+ي����>���%��e6�~"z��i_�bbZ�0RR�Հ���^V(��>+6�'�ʖG,�tHݫ����}������"{�2/v���� =L�����ht߯�_q���v&��zHK���T���(*R�sC��r�^�=���-�'ge(��ؾ�n��-����z�qc7#=�l�f��d�wb<�ߡ���a<K�a&�$�z�O����\u�.!�}H���{JX��c��e��[T�w�XZ�Nz�]�i���-�s��;gW�eYE-�s��'�~�Yd�l]j�~���f:�-�t<�7��}D��;��YX#�(�2hJzTj���g�J�.���Uhإ�����Ĭ,qL�m�=�vJġ�>�������j}�٘z���nP�<c��e%(�ha�.����.{�L3��:fK�\z��,A~�C�|' �!9�4����d�9rq +~T���WreZ��w�l���U��Ҏ��qKzD6�[!Aq�{���gը���A�幎j��kh���~�+řT��� �����ߎ�\�:u:�?����*d���+*�,��]G����m�@G���f�S�"��G��fUj�`�}���oR"�4�� =��碂������cˍBvy�\4�����o=��9^$3p������̄����j�l4"�O����E�:*�:j,�����l�p.���X���8���f��C��WK�n�n+7�s��˽��a�N�b�o<���|�b/;��L�a�~�� �\��WZ�rܩ�D�ʨ������w�H�o4f O��S©SW�;��j`��-�L�J}�G#��d��"9OM���c�R���5������ޥ�H���bZ�ܸ$���{�f�|R��V,�c(KB�#�Շ�M;>sM�i!(7�B\���f���{U�t�/�$� ���/�����H-8��!���A<Kd�S��RT(��� <�d(5�G@ڷ�3�h����`KK��\�F;b�É7)LKD����4]]��1�R���2t�Ar��������m��7�;���LR�2��s���uo��b�L�e��}��/��$XG'����A#_o&�"4L��b*��CC�&�Y���,�A`Ջ X�s����C msтI{��Xn6fM0����Ч�6[&AD8������ަ ��Hw�a�X����*��l�������#�y��;�S�H��s 8ksol��@~ށ�J9V[6�%q��U�T�4XE�����G|�|H��mP��G�+�mߔ�|/8�����R������=ƅ�\�x�F6�ͪ3[���6��~��G��Ƌ�p:֊� ��z�� �!���%s���8��|���X����9�mH��9=�wl{�/�X�D c4sc���A��~���)%J�E'��8"`;*������t��� ���|��\���m����̀�ޘH�#��ؚƉRcs8-Y���Wݯaz������X>����']�rg@X��/�)yn[q%dSٮ����B!�I���ֽ囚!�y�,��%E"���H�M������ӊM����U拵��x�Bx�C�Y���>�)G\pD3 �|ӕ�s��K�Nw& ϥ'qYfO��K�Z,R�?�v��ݵ�l[$"���7��X |-F��f���,1�[Yf� ��g��״�;R��{�+u� &��F3����```�L��q��P[�A����1��Ŷ���vC~f:�_`���&���# ?|��ߎ�S ��_>���r��9������S�[������!s`?iR�l�Z�#�c=�oSV�l�d����Rm�c���G$�sf�g[�=��}k�x�F��W�S_�`�T*F�i�ox����AxřpPꎶy��J˫}�(�� ��K]3�O�:d쎗�M5<j@�5����[�bd�o,�Y��n~Im�#�*я�"R?�`�?� �'��<X7�,7 �A��3� B� tK��-�ȉz��D��`;.v��M��ėm}�4O���[(�e�0�z�SƏ�v��3M�%0Rh��Ch�P�����KEZL��$R���1��:/�>µc�?����/�ݥ��ؑ�P���qi�Jn���HwuU�t�7^���[�O����n�,�<�en ��v%�v �k�^,K<�YM�x39�� A��� q0}d��@'T����>v�[9��&�2!�U�{H�H��[g.`���xg���R�\��=K_t�;�]w�kԹ�\�x��F�{�M��Տ�Iz���S�8a��z�.W���I�[�����WW.3���{]��X^- �,+1��?��*���S���.� �rvf2�r��/zF�("���s�������,����!Y5����͡���GZ��N�� ���7 �pͪ �!���c���O�]�Rb�!�"��zHa���TG��Ls����Ӳat�+�q�B�%������x��^�����;�B���v:eB�j�w�JƋ�������y��j9�J�#��������H@�d�L���U�ݶ�U$B������fsW�Ց�L�j�K��S�-���c]w?��sS2�e����W$Ʈe� 틴�a�uc�,�{aܔ�(Q9�w�Ҩ;���>�o'���gp�$�N���>���m�H,���H= <u���$����� D8�+,shp u�~9uߜ�Z��MƦ���N���Y�i�cG�ԏ���Y���A�f��~9�������YX{97�����Ǫ}@ �m�ЯK�s^t� �Q�O��CQK�g��O|ljIWO=�Ff�h=B�+I�Űś��%tņ����-�/�XLlR�տ-l�]�8�W[��~��|�1.oX\�q��Ĺ�6��7��D������G��i� k5[���R��:��Z�u&���2��,��s�3kxQo��Pi#�������%�Џ�[�Lj�I���?�9%�=�o��ԏ�F�|ͣT�@��l�����UL��D�}�)��l�Tr�N���q=փ.4x�g�"i�df�K�n<੭og^�js��2�#p��X-F)m�ظ���"�&O?ĕ��e�kI:��� �8��q�g��@�/���ag���Ip]�#�4���_ٰ�y�|5���w[��F��9:V�ԋV���)�,m�aH˚](�N��*���ۨ+d�r�EM�{�Y^��C҈⡐Zď?+G� �ʠ"ꀠB6�;��D�
Static task
static1
Behavioral task
behavioral1
Sample
driverspoofer.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
driverspoofer.exe
Resource
win10v2004-20220812-en
General
-
Target
driverspoofer.exe
-
Size
3.2MB
-
MD5
88cb6eab66c748727acf3045492e667e
-
SHA1
b79890662bf4d4c23f850487bec1dda9b215769b
-
SHA256
0c21daa2079e54a282055990d806bae58ea439ccc6818a18baa484d13b3fd6b5
-
SHA512
a4d2b1a16b5670b9ccad2dec2d530b2f12de37c247e616a63cdc7277681362f63ac421dc036cb633f9ac658f3aab47b53a3a93b75c34e5b0b482cdf0362e0ce0
-
SSDEEP
98304:AnHg0lBm/uVyAqMWHZWXTF71C50CPnB2Tb:mHg0lI/qFZYFZ2
Malware Config
Signatures
Files
-
driverspoofer.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 36KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE