PespSpoofer[.]exe | Triage

Sharing

General

Target

PespSpoofer.exe
Size

4.0MB
MD5

8f89fbb0a0aeedfa6a8fce061026f755
SHA1

74cc9cecb3e05fb83e6d3f47b4c6f6fa07b39808
SHA256

87f80f12e2b4b78f27784e069c1218413666224eab1b8d50ba043af5551a24d4
SHA512

c7a44f513389ebeb4e8595506296e668c5c4b205baa4326ef711671de3e21d06eaf3afc11d5e9e88c2fadae198bed11be280a4a90a0a1e761f1fbb5f16d95ec4
SSDEEP

98304:TdNsK8ifJxh8inu5f+z8S7CCkqXf0F1+KH4kpc+DX/0HMxFKv:fsK8ifJjnYf+T2CkSI8KYODVxwv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PespSpoofer.exe

Files

PespSpoofer.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

/V#k$
Size: 502KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/V#k$
Size: 502KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ