okaaSpoofer[.]exe | Triage

Sharing

General

Target

okaaSpoofer.exe
Size

2.0MB
MD5

32cceb3c70c263ba915ae9e961669482
SHA1

4fa05b431dda6d1a05f08ecbd0af2ddaeaca1438
SHA256

4c554617bdf5cb6e5b770652a07e68e1d37c66d4e5fd059c76cb503d0eada0fb
SHA512

b50fb50b934ec56ff5e44976b8de4459a5440e5d9301e0637128e48b45634126b99e3fe19743470defdcb12a8f0d8c9aea48e919643e6a0ea4006c2a99ad3191
SSDEEP

24576:KSJu5rhZ/wVoXnNMRKMlgm5ozsInrx8VkbURa33yxJQ32GCZC8h2jubOmnzguIa:LgNR4OSRtlgmOANYCk3CZC8Z6uIa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
okaaSpoofer.exe

Files

okaaSpoofer.exe
.exe windows x86

88381b84da56810b869e897e6d45bd58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

EnumChildWindows

Sections

.text
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bxpck
Size: 951KB - Virtual size: 952KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.main
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE