�!�p���d&� 2�ا����N}v��=+�*j�1O�Ndw���/���� ����gw��aƽ���p��>b�- D��y�KHuP���猨����Ƹ\MQ<���YPx����$���V a�l�fZ\����`�#��p�x@z�5�Qa�W�ήe(2�7�d��7�8C����P:�Z̪,h�Ex�2�/�^^1d�'�� ��ŵ��eď�!ɐ�Qj`�6��������N��" ��&2OP;�����n'�/q�&K��Ή ��R�����KШ�;�v2�(p����6{,��E����՜��!'�����.��[��0��N��[��S��Y�K�s�/s���w����m�)J��ƪs3��}уЯ'{@�|Klӂ2� �i�D��ϯ������"NNj�jq��da�:���$��Z�Գ<RY���*/�)�{�儅M5�I�>�r�T�Q�E�����6:��0s��K����VkL-AS���r��͙�^��l��i�*������t�z`l�[�%]ނ�_�ھr_M��sZ��U��!W~�tdE�2� ܲ������\s}U��˕��|��t���]@��sY#g?���猈/�̰�G��j)?�T <��k@���nh�����lI1���J }�&��)PI�D.9�����k����V������+ 8�di�E�u���~���8�N��'����#�6:���bt���� ʭּ'�d.�d7Q��D13��x�4z��2��c�^͞�a~Z��7�ª� �����pA�Z8^�f&��5p��(1��!S&�pu�)�p2}��@����5���v��Ѹ�L������ۚ��� S�߈�KR��oN�6�����k��9����A�VZ=<��q۫D=�ߘ�Z%�pp�G2���G0)�L��]�n6���Y=�`r�Va��=*�72ʅ%��+�P�etq;U*syͿ�����1��H�o���N/~���e���x��;n�)4\/4�����)�}e��9�m�N,�+��:8#�p�]}'����|� ��d )H�^��-ރ���@8Y9�T�O������"������0R"h\c�����K�{q����E��/� �`��/ �i]�ڠ��W]�Ӂ,�&���a�[���fn;��0�EWՔe��@���Z�')?���-h�K<(���f�%L�PY'+ Ҹ)�}�NVQ*�����5�,$Ⱦ�2����б'Y��8�zI<���dvq�*9rG��q��^x�ɿV̅�{`S��r��8۾<�@f&��x4ȿ�biL$��/���ow�]W�-ϤM�d?v'�+g�!�n筏-��3�쉫}t�CP��Z���p4�':9G�ibr�߈��u��rcb5K1ÿ�N��k��^$�}�eI�&K����h���]U������5�n�Z�Ж� �"�^¤u�y��ZW��U �]��$4���V����#ާ��l|���o6�+���@c1~�[1G��{��I�76��u!��9� "�1�X5�t�o�� �#<�,��mG�r���|l8����� ��>D�����}j8 �9��)�;M�$R�rB�)�OP����u9@ ���f�v�Ԣ�ưtWIl��.Y�?�%���ǧ{#���ߞ����y���d����m���G��~1{�/����٫��U$&%�[���A-务�h�}�T����ո�/0��L�T�Z��/bX��![2M�F� N�{����_!n @�yƫ����:�P59N�@�����]�vj/L�kG~x]�����<S�j�d2OU�Z$2!2�/��=�\[n�1=���]#V� Q��kb��<������k��uS=,q�@�ьd|���[+j\�W�E?��iBb�1�<%�,E���i����X��ܤ�!Ƹ¾�ɍ�.�O-*yJy N��f�#��2�e�. N %UH��J������QV��V+��w8��Q���6�[�4l��S�-�A*�XM���Ư����Ōx�ë�i��I�B=�������?l�7��C�l��l�r�����8>N�m2"��P~9 ��nJO�h��k�l]~��2�~*�T��'ť��w��'�誫��z�|�Ъհ�L��k�������;v�w�O�sReW�P7�5b����c+���������@� �h9��b�d[E�?��J����g��L�]���~ϸ�lό_�*�[w���璟�W�]��qo`�^;P*�+!w��[������+�}c��m̕�{�%,Œ�9�P)g����D��14���-V���ODi*ޝ^��h�����n�����H���m�;�7+���vn����l�j&�i��ez]������=k�G��0��X)�6��sD�Jf{G>��g�8'K0�X�gU�Q��=������^��������}�����i������t#_����,�x�� ��f@���6Ī��XĎ1��/K#�LO%�� RʴA<4��c�W�V�K�ø��#�,��x�� �ia!��S�n� .I�l8%�� UZz��� "%⓱6u�m���y�;�t�i+��qף�C������iez+��Nѧ.��S�9��1�`ZIx�XG�� q�=uAS�ףQe�`��ӝײ�L�}g��eU�J'ǵm:ǃ� sHI�y+���6�0�m��DA�*�G�Q�u���P3�hx�~�<PNo���`e�u��[�>����P�z�_X�X����"Jr�nt�A����.q��hz�uD���2�+{�q�#���x��(��0�]��K픅Q�$R������ �����)L��* �ep��.+�?'��v.�4�� ����/;����'ǩ��͖�\��(�y��_\�`�P�Z���6��*���UR<��Uٱ*��5��/��#�'�73d�)_j�R�Ȟ��uk���:��f<��:�����`���tP�?9y@[�Lc��А��������5�_Z\g�}8M�:���徟��Ł�#s��]��~c혛����NC8��6g�0�� ^�~�<��4����"�ݫ�!
Static task
static1
Behavioral task
behavioral1
Sample
Fusion_Ware_-_Spoofer_V4.1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Fusion_Ware_-_Spoofer_V4.1.exe
Resource
win10v2004-20231020-en
General
-
Target
Fusion_Ware_-_Spoofer_V4.1.exe
-
Size
13.0MB
-
MD5
dceac3cc2949114b46194a2a5197f4d8
-
SHA1
13333e7c73b4fe1979fdd523a18e162bfdba31f2
-
SHA256
06d9aec195f1b5d26cbcab63430e0978d775079f850513e0ca17b87082ea3a43
-
SHA512
40fc257d1f694645686c0d3172b95a6680914c5bc76787ef275c29b0ef0a0314ed77f79bdb138372bb872bd5ec30f0724c4d74fc25de16b747d2bed15244835d
-
SSDEEP
196608:JqKhS4rFSnAoC3yQQewxbhvx2pYHSUxQa8gtjmSu4uleCgDieAHjguY8jOmym6j+:JNNrFSAnpMh4+H8a8eySVuwMk2Ds+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fusion_Ware_-_Spoofer_V4.1.exe
Files
-
Fusion_Ware_-_Spoofer_V4.1.exe.exe windows:6 windows x64
2ebf226287bfed2827f34a2b7141e90b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CopySid
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertCloseStore
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nZS Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.o`4 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. iF Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ