�g�"��k�� ��1��u�β������{�]�?_*H�cu6�s��h��R����O�[��`+)�ó&� ��Y�M,H�#-�Y%eo�gC�Uv=z����9����Ւu�2�ȑh�O\No�xe��~���2a)���LIv!ZF��~hO��)S�=Ѵ�k�t�$E���&��)ײb�<T6� Z ��gε,}�cJ�����&b?�^�23��.S����V\?�����IMP�d� ����)יu��im<t�J��E��3�ZOve�T�4�U��4Z��� ��I�%�j�~��@:���74*WmB�j�&�a0�K�/��9��YVz5��6(G�� }�TJ�.����Z���b�|�!�}v@Am?Yi�NJ�R6��S��1��[s��x� ��}"n}��S�xś#(�"(�W<r.�h'��w,�T%o�U��OИ{���+ �(�?x#�M��O7�[��6�ϒСb�p��<�]���^�f?����d�?ULA�G�oPoHl�n����J�� 'R�����5-%�V���(mB�pZ�4Q�.����-��y0�u�d��������:����1znx��5��"�x[ }�{�����ٹe!����H�LBt%f�]SnO�7���l�H�U����J��It\���1W��t�i�S����εOuR!I�']H4*9H�7��=��c)���9D������$�RZiQqّ�ϕX����m&��Ӌ�a�0�y�>�!{.�C�+�������O��5~�c+6��<����hs�^�=!i��� $>��J stY����A2���1�#x1fW����j�A�6��Hm1�d��sL��LL�f!YO�/x���syn�vA ��mH�Ϩw�2-�r �#�c��Xї��CvE�ޠ�.���v�J��F!���sͼ�5���f���3}���+�=H�!��F>x��l���Qj���V�!�����3���o�~X���D���$�c#�c���$�S��4]��=�ܧ���Ɇ����Iu��>�Sp`9��o����6���&C��(��f�vMR0D^+��8�ۍBH7��������d��&�"�I;Ѥ�4Y k�W�-�[��Z��R��HX��c�^���>B>���*���N�!�0ŵG�F�f)���O��n�<$��r*(��Vo�f��M�m<�քUOtm�*�)R7��iG��T�`�3�Rw*�~s�w�L�ۮ�B}�]�)X������P�XY�bRr-q�Њ%���b����r@�sf�����D���Xc*B��ȽT���r����K~�j���{;9�; ��y3�V�9�y�˨�U��$��z�ɝ���S0.\U�������Dkg�=mrT6�w-:m�����!������~�þ`��B��n� ����~~#��]�6�5���Iw+�C��KO�����<9`��J��k��I�1������I8U�}�� y�5�UH��7l*�#G���"���������u����\����!���C��S��}���bO��ȦK@�M��f!^]��8n�6�W�(ࣦ�����0S;�D���p���%����ijk���Nivu��uˆ>�S<+V�ܱ�E+��ft�+��r��*(]L>2U3��7�̛E��) .-�8����:?���� �+'!��ǜ�tL=�l;��1BqZ�y�c�b���.�Z}H��#��m4�d�� ��0�� I� �/�n��F !Řo� ��I�e:��2��u[�/>�����Jk�Q�H��6�+�772ctv�[�H�}$������"����ME�������p�%��h&Fv�?���r���<+=���ϔ!Y��P/���(�|��[7]YW��&�'wC+P^�̾J0)�f�ӾD��k�0��n�msd�d_L����!v��H�K�,�������Obeed�ʙ;~�ͨ�X_&�Ԅ�F]�չF��ZA�'��*g�r�l�BO�������ǖ�q�tp���ern�,wP+o��)�����[��z 0p��)N������T���?�weid�I�r,�)1���/殯�����u\��E�ъnp�s6P�E�@V�n�#{�����aD�����Υ���~/s�����`J�:\�Jyc�B�H���^�$S��|�U�)�fN�M}�����F�,�a���d0֩��uH�C/�b�R�_��Jб� �U_O�$CPG+u3�D��H�L�5��={�i�8!庯� b-��H2��G:���72C���� �<��#l���'bH�/��#���W@�\�N�-���_��-IQ�&/�D�>G3�C����(ζ{F�T���<˶|�õr.]Ũq�2�{��U�����Ÿ��\c�D�?������Ys��Xs�;:������d��5�@ �'�פ�V�HQ��,����@2أ**���zj����uw$M�h�5߅ v�w47�_�w���E�g�k�@�IӲC��hX��g.8h��1<�z� �Քb�EĈ'��SX���gN��GD]�i� ����<�������4-4�_���B7"�W"�A.Ns�%F���iFO��vP�*+�>k�LU���{XIS �۷!�������ݡ*�(bI�o�Gs��yD&W�x���$�� �r��=Q��� � %��>wR<;c�|�9�-2m��u��������xU�?PS�,9)�����{l�kGc0�4r��n��c �X�q��r�F��bkPx�)����FO:v]��©A�R�;̘�,��R2ɶ|�{O��l1rR"�n��nf�YB�[V9��X�����z�xx��Z&Vϲ?Y\dO"�彽�@�70����+��4�:�)y8�O����:������ /�Lu������)�YIVR����8����S^#=$CRi���kTX����3X�EZ��.cK�O&6|���R����z�X�_��]�:���$�)�=z�����n�< *�q�E&,1��"p�EÖ� D=>q�8k�H+��s4��֩�KNp.K�t0���P����
General
-
Target
Spoofer.exe
-
Size
6.0MB
-
MD5
c2bbc9f9732df8cfbe9df86551f889bc
-
SHA1
fb9fdcff94ea7087937c98d4ccbd829017569868
-
SHA256
23f199814229c766750959fea8c74c66b9193e42b2398b441ff8cdc50276b380
-
SHA512
c379358fbc0e0162ef66933b4509fab16f2e1037fdb969d9fb02620de69ea8480d9de3159cdc81e20703143b4b06083cc86080deb5b2bae81f0f3eb9c9e45a75
-
SSDEEP
98304:gWoMCTMHccPrdm2GDlQe+sHnXmiCNjI/WtM1J+Vhu2r:zoMCAHJPrAzxZHnXz3/9WVv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Spoofer.exe
Files
-
Spoofer.exe.exe windows x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ