.����4����_Ck���m�T\�� ���$O ��4`H�1���WEl �q��M]�S�PT-S��" ���ze65�C�.�\P?Y��\ Bj鮋�^9�s�6�)*$�j��Q�ULGٔ�� ����4d���gA������%E�ҿ+3��W)�"���A�P7J�C-�}�O�3?���gZr�}���["Q�x�i�|��������_m��-��U�"L�� ��� 7 o;����Y��ԁ���c�m�L��u7���c�pc'�d[Z��$���A�K�ɼ��p:�l�q��q�;�����-}������#�]�M�,i���"5P�;w�g�|H����a��˂���vC��9[�����9�����O��Ɂ�̸F��y��OW�4��Po�����k $�FD��a�BV����a�ܺ�ܫi+a�꺐c�t��ێ�e6�����eQ�*I�i�vpH�&3��åg�0�Y�_>��斝���ہK���t����S��INa��V��ֆ��h��1�Y���"��<� n܋U�������V�8K "��,�N7s��E���,�S�E��h* �p.��>�ȧE�T\���s՝C�j���$X�ݺ�C�mz���7욓#�z���J5H�FHV"������v~�r\>�,�Ý�I[v,��i.,���Nt��E�ŷd�m�S��./��:�@a�f+������ĥ �N�����j�^�:��F�N솞�z����s\� �s�k�������.��n����'*�~w�Ҥ�~*Ϙ�D~g� Q��|(��G�߮�F�e��1c�|Zٛͅʊ���OIF�������'�/�C��3-��RF����d�Yʇ���ů m��%;��'�[�$��μDT�;�#�sw������^ L�����}�#1�1���� �A�&W�L��`�rm�8��B�t���"DC,��T�(�ڴl����D�Ǟz�4`����F��e0W|����F2�H�d�nߨ���e�F�N~+,s)88���ρ~S���� r=*�g���;��(����r��0�p�!�M�*�4�z�ΎlK�����������_0��L��LPj�W3�Q�8�_#Op5� U?��ߗ��9�J�nYI��`�"}�{k�^� r�ݲj����P��EF�d�,���hP��Ч�����gj�A�0��#��bs��g�����]a52MO377%��s��.�㙑�a�D���v���U���ie��VA3�/�z�C�N�:e�rU����XHQ�%�m�����C�s�����o�r����}`�5� ���^��i�E6x)<���$����j}�0����@*��2����_�%����&�R+�2ci�K�%t6�!�F���L��h�����#�c�db�D��JT:U�+��/�V,!�?�� �B����2�ʙ<!�nb�aߏ�/���4�����O��=ʵD��]��|p02H?'��4t{�r�(�������k��܂�iI�Z+е�"��]�X�Ʋ��j���WwY<�]��t�0��d�����N;��Ia���6��v:qյs+�8S����<:࠴�9+W�=��e���YTЌ����N�2��'��������|�+!�yaf��դ���n�'�3:��c�A��Bvc���@ �?2$/Y��I�⍲��rh� �c\X��� ;=�/��г�,I�h_��=we ��+��i�M���l�l}����l"^q�G�|�k셍b�'d��_��O�'eӬ:�P&��"q�s.dO�Y� �`�GKo�QP��[x�>Lȹ�#�A\�Ɗ�0B�b�� f�N�;MG6������L���p�w���L�������23܂T���P �}�`�Xhl�LlV��śj/�����!��Ct��ȫH�C�&�2F��OKc>�Q<�q ;ƒ��J�ОKK(��Ӟ��F�� 5ӹ�I��E�yav���j�'zZZ]/����%cf���)q���P�!���R���4 ����=�����ZW^˩�iI�� >�}�&Hk�֢���M͚6O}fuOX��VQ/��RY��%#���ӝ��^~Jx�8�Q7O�Ŀ���^v�{�q�#���@@�mҖw"���m!h$�@qa��:�0I�s`d+V�Nk�ɦ�������s�LXo����?�`��I{����m����pz]�O�B�����x�O'%̵݆�B��D]h9����/����eg �e}� �/�]�l+�"3q�(��q!�"�U�!+֚om�)�t&���AQa�JQ�����om��4�E�N 2���E�x쾲�4���0�L5��}S��`����}�_�&w ��D��*���^��T.���K%Q�Ѩ(�oU� ������ $T�b���F��9�@�o��������c�h{�&Q���r�O�lb�����23A55t ����M_��LcGE��<�$�Z ��Ig��yh��֪���IiC�i��T�a�겷��U\��,<��]k�-kQ�t�Ԓ��Th%#Ю~o)mդR�^$���~��a&;��X}-�$��h��?#�ߧ���{�gK� Sk9������Sd�ø�(8K�ӂ��y�`$�g�6�w u��56{�B��m�}�S 'P�'����2���� ���5b�sV,J�����{."�֭���է�Ճ}���|�dJ�2���X/.]%��Nez�ź������hS ��z^��� �^ʃ1{wg-�8�t�i��5���S&_L����DX����mM�;Vˀ]�,�m��$T���Zu9�y� ���T����ސ�vW �x 4-�n¹t������Y�/��V�B���k�N�KW7D?����N��0y�&v^GZf�[��߶�N�rU3�P.G�i�O;w-���l?�`�ؚ�I�h�vpЌ�9N4�;��L��[���=�*{*�kp�ȅ�W,�5U���}.��MkIkH��{��{�Y�҇ن�ܫ�6���m7X �@ɺ�+;�<�~~��%�i�K��09pև����5�%9Ii����嵆�W ����I�_g�Zz�6�����d���{5�����?1��E������뵓���.2�12���u�������G�GzKhK�/o���D��)M��T1�Q��$���7}�tm%��X�`�������y � �� �J:g�<S*�.�p�E��Q �wr��שּׂ3��I���ɘqolʨ�0����
Static task
static1
Behavioral task
behavioral1
Sample
HwidSpoofer.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
HwidSpoofer.exe
Resource
win10v2004-20230703-en
General
-
Target
HwidSpoofer.exe
-
Size
10.1MB
-
MD5
1c7e9a0b403e5704f9796e11db670821
-
SHA1
45e6d30f23d5a15f9eb221d7f1f668bdf6db20e7
-
SHA256
a73af5c609c52ef95793c9276fa7d8bc83a5bdc403e59674f96853d099ad44a3
-
SHA512
3cf926e93aef57df46427d700bfd122976233f73ef83e1bc0050c51759a03210740125d79fb20b2f20112b3eba8d42b72b808a3e14c2464c2dd6c75a818f67ac
-
SSDEEP
196608:VOzWIJYtnfVoH7900tNjlT3pK//kaNoGivI1HGrD3nL7iLRnLH/qagtsaXIgWp:86IatntiamNjRpK/MfQ1eD3f8dz/PgeN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HwidSpoofer.exe
Files
-
HwidSpoofer.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7.7MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 285KB - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE