�2���xJ��,��P���X�Xr��ce��<�$J�g��K���ZR����`��S�:N���@!��:Ad����a�Rh|�0�D�'Gw��J��V��X��Aj�Tؽ�<{��p�.-~17Gm�N+�� �(�����ӟdʮ��y�ش*Gl��,��=]�8��fZ��.����G�b�G�߮./���yF+�:h;)�8cxĬ�%��x�h̯I"��zWt�ЪN��-t��&�|�֛�B�\����C�o��j�~�Pr:"���a���y��}�7�:J�F���{�.DaeS8�M�K@��,�h�̖�y�uaz���q�it�&B\B�'qZ��EQ!>R�ؐf���`ٞ�1b���G���"��F���Le<�C�)�Nu��M�Am��>ͪv��[�g����J���w��Y�6�>��S�@;���x�C+p*%�0�n�>� ���K��g]�� ط�7b&��s�-G�,�F��7��K�t�������2G��nɉw�7��Jnס��#U^���&.)�c�tP��1]!+�"WZQ��4Nr��yd�{9l���[��'��|����{��l(d� B�'B`��IPpQ�S�`�"����A2�.ӻ�� �G��[���Q���r��Α�-����>��A)�ԭ0a4h����iIre���,���� ��I������� �M���[z��{���ڐ3!�ע�쥠��������{���6~� �D�ǚ��x�j��n�dB����K4!��K3x�{E�{��H��5=+�V*�K,�5D�~F)�_�wʘ�blc�Yƽ�e��*^H�� sG��rT,�t�1��#B����>�����K-f-y���<�q��~U�d vtI�Hh#��~�F��#�W���f*�������ri�Rkս�p�b���F�跔Z�%Z���(�7ʷCd뷑o]B���z��K-;�c =ؒsQ�T yo"<J|K��Qx���^�i�HA��K8���r*�W�{�#y��� �Fp���J�����`H�\��)8i��?��%5hM�R�;���Q%E�):Z��%��w��a��kMfcL�E,���1l�`?��0wb���00C̳J�:���#[����8z�>_R��+D>���Ϊ+ߒp|�qUK��Z��x����FmG6����f�����ND�)��ztXQ?��?�;#خĞ�Dқ�<eC���.Qi+`����|3k-��Y�M�WK�.̓�c�y�~����XH(�zL�lO^��^?�}UW�@4Qm��\O�Z���I<v����~���n�pc��E� d�Ά�L2je*������I��]g��-��8�L�V��-�n���ڳcAT����v��4�ͭ����ө}����p�G9.��Ӯ<�\tz2���GC~4����x��H��g5�[/��A3 q�PF��P}2瞯pܲ&~u�D"�5B��(G������a������Ǝ�(^"��)~��6gF�^��� hLndS3`�� P��å�$x���f����CA�'�ϰE�%�mg�����8xe��[��a��@n�X�R>�<�?�gߔ�В�ÔU��?��Z�����h��PL_'��Kց�khԷ���ҽ�i��L�$�p�}"�8CG_���м��Y�<��^�K ��Kb$��.� �� �}�&}i��6��*�FZ�}g6�Yb!O�E""f N���:�!S�FNܹ��}z��]w&{�݀ϱw'h�ѥ��er��y�'�61��f���C�10b��Y�PA$XB5=��b�$ڳ?x�����������s��"�q�F�b�(��xj�P�0VMԷ��M�APHh�;)��A���B,L�A;bT��{~�u]hl��iҏ����z� 2e�9�?�߂N�[%��g$��7�����9O}�SҍI��@�6~8�p噳1\,�CD2"ಧ����6�>G��6�ZRg4[�SX��[31�������������E�7cd�^0�\��N ��t5|=��(�f�/F�cܗ։؍ő��f�JY�J�?��;�a�]���%%��0�0=�Ÿ�_y4����S|8�n+L4�\��(�]f"���QǑ?&��w���UNudT�j��+�*Z����:s���S [�8ץ�����-ǭ��3�|��L$�6�h�jXv�=$M����=��&�о�d���kiw�d��Vyf��(I�Z��)Ϙ��3-h/�����e6'�S��V)9�� P-���p��������{P�"<kE��tsT�p[ߨ�C�OX.8@Ϣ�e�O}��O�<lv���'��u�� �k+/�_�V��;���B�pq���Л>��Y����$KO�|��[/v��F�O,����[����'Ǐ�Q�}�q*=���u�����xj {��0�!�j�RG�T�8@�xI�p�h}ZE�?�GB�$u��S�i���T[���{\����O9��M^,��)���hE�(�S��Ҥ�lx3�ր��"|�%�߆D�}��c����X�� m�r"S�c\���Z��m�n��Z�;/���gI6K$�k ��oE�\b{V�b�Xv��K6&<�@�q;�IXӀ(@L�Ym.^�m�/�`x�����1�L��P6��,�1���³��fkT2�W���JhdRn ��@�mśh�mdc`�,S�3�T��-�G�������˦v6�� �mM�Hu��P�7;����]N~a4�qz ۑ������5(W�����Q�ĔO�=��9�e!�� ��0/�0e�� �Y#t[�)+0�kp>Ͽ�,W��Y��5�6� ��y��Ū����"��Z9RRu̿ h�.�bi�A��f�+�������.*(V�qq���m-���4P�1����/ѴY���UU�2��&����O�ί�)�_�ߞi~ŌȨ�?\%�qtġ�0�U����w����SD�U������6�S�-�ϲVz`;����P9Ƕ`n�k�5�O�b�^cMIjs�2�4Y�tԩIOV��%��� �Ԓ9T���!öv3�oU(X��B�%����J���y�8l(/��%�
Static task
static1
General
-
Target
Fusion_Ware_-_Spoofer_V4.3.exe
-
Size
12.6MB
-
MD5
c6bda01952bf9e28185c46d23d09a696
-
SHA1
b58435aaca6cc01f182d286bbe7be0832228e794
-
SHA256
fa55c08664bae018d2287435cf3f08840181b5387fef5a971a52cc67d257472a
-
SHA512
59888febb041b539e2f9f424697b6cbfcac367a3b2e87e10bb77cb5910c226e2c45f579471019f9e9deb0fb53bda593c3bc51d77e4a058f7e52f14e8b9855505
-
SSDEEP
196608:TI5Cw5der0NN/cn2SnJ5Yo85MXVnTk1SLehsXZF6wxWacf5MTnLl4EtCCs/x5E6Y:THHm01nJcsTfJpFtMaS50Ll4LvadtOA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fusion_Ware_-_Spoofer_V4.3.exe
Files
-
Fusion_Ware_-_Spoofer_V4.3.exe.exe windows:6 windows x64
2ebf226287bfed2827f34a2b7141e90b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CopySid
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertCloseStore
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 560KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rC' Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aN_ Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.b&, Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ