��^"�r ���5��6 � Ӷm��\�Ar�#$��Tǚ�@���'�&�w��k�;�s�7�)��"'|/��u��&�ܞ�C��3~�zk�cd�_��Ah��_=�����4g 0���ƈrX��bS-���3z8��D2��w6+�v�-��g��?j��;�A�p��Ix'?S� L:�d��<��<�w�LT��3�N�d@|㔂4��v����q>q�쫕��-�r�z�s��0���)Ι��?'��0$�_I\��ĩkPۀ4�;�T�!�d��6���F�����:�6�)@'����V9�����Y��е� %�0���lV�e���l%�7W�� ��S�bڸ�H��ߚN;�-#P�l�t���@2 2"��@��İw_�A�jj�'�R�7�R�P��Oi�}���x��4�u�g5���d�U���>�+�~jz���e؝B6yԿ��nf������^���(u�������^v��:6?�w�}�����r������٢v���AI*��|Lp�e$�Q�7o|��q��x�o�uօ�CO����� `�V�K�l�3�z����!��JS���p�:�"��l2%�w��M@F/��(#]0s~��n�F��^ �U�D��Ʃ�ѿ�S�v 3Q~�#<^]�\���pu�������+!��E�K77�?1ô�@�,��`��������1���)����*��[�z�NR��d����ʥ�o�G�=+�l�X0`������Tz�%/7J�`�>�`}���ԉ�W�[��� ��u�ឯ��>�{Ȇ��*ĜR��c!�������z���E%x�fu&|8o�B��s���JHd<��D<�L7��S���<ݥq,�����Ն!=p�4��]�#�/�@)[���������s �G�!��6t3��е1���$��a��B�G�qs�f����.�=��ߐ�mNA(�4 R�=��w}e#�������t�A�&��3�b��ړ�n���l�!����ϒ�2�6n!���H�)��m+�C�ݏ d�n�'CU%bx���UB�m��L`���}�ĩ�ʈ>�rW�St�G�M���x�֊0+��A���H�Oҙ��W2�e� ��=�d#l�'T�s_W6�![��\�� ,����-u��h)��Xu����Y������P��ӱ�G�����Q�#��/r��f$�]�5���H-�X_���:i���'�W�tM ����X���%X�7%�0_���8����i_�G��7Mh�OÌD�j�Yk�$E<��p�� (\?�y2Κc���[�6�[�+]�˸�����h6���d�nS����r�}~�23CfB��e�9�ӄxN0��-,���7�h4�#wѢ��?-D""�b��%�(Z^S%�Ñx��q_˺������.{}��~�$l��H�x���#���etn���ч����1�����x�z��\�IJ�ZG���#U����`7'��n0ߓ� ��f�SW�yK�w�4���R�,M�S�{�dnB�����}��ԣe�P���i�Gl�|�^�h�_S�6B���&6%qJ�F8 ̑i��# ;�TY �l�?=vR"7���u6j��� �S�}����0#a���h,0����'!#͝¯F����l��jl�7�>8��H0��f�+�����������r���O��VZS��`�{�V��H�xlv�#_���sZ��y�k��F��/-^W��w�֕�ņ:1>�*��������M:�~�� bo�C-���j��zDy�\{�qu�ߢ��\�pY�B[)���P��ڳ�ȵ���dC=0�M��HA�ӕT���G����Ϭ��娛����zE?Ymp���Ζ'���2D�w��6��N!v�02�9�Dr��v�!�%���M��i;���-�f�јF�%e7����Mdbq���kb�NLcdX��a�}D�A���5������ٴ �X��.�#��V����^�2z���j{�()�z�_Is,*��`�GE�H�|8�)4�(���S�(�r��������k_Y���S���R��ϛ��it>�T3R�Wf��vd`"(D�z���\���6x�P�-�ƫ�@Fa=��͉�!���Pm��Nv����4��z���=ġ��� ��sż����eQ��E�(�ɔiϊhp^Q���ax�j��S*,(q;�Mh��މ� �m�q_,q�G/`-m�¤����)&�,�=ш@�'~1 Dth�D쭫x��iT �g�šˈ� �~O;�kGb IԞy�"�=�Vi�X�7�'6�^�cf���S�T��$��r���e���ӊ�*�6u�p��E|�(zs��">I��l�h'<5TI����`��c̎q��_\d�n�����S�-�p} �]d�s>��'dH�|0��8�?��W��rK,U]��C�ѧbȱ��]��a�F^d5łi;�;��� �/I1��:\-�������w��c���O�q��5�X.)Hc�w=��7x }��vjwM.�Ee �� ��|�|Z��*�����`0��<ť�����D)����<���2�W��y�o;ȉ35Ș`����܋Z��� *7��C�s�?��le~@qbf����M��v"�-1Q=���$q_a�ՠ�>[��q!k��G�X#�% e���JJο.��%Oc?}VD#���7���0�!z��5#Gt'=�1�^dw4�t�����{�r4!��aZ������u�&dM��O��w=�<2�~���``�ZAJ�&�&��X&�I���\�e/*�7ȣ��6�c��QDi:�y�"wP�©���b4���7�ß���D�������e�j��� 6 B�DMDz�H���$�n�{��h`��[B�i��ݪ6���6�C��5 q�l���D��#H�@U����U�:����&÷]�X�[�{��wgu�W:��� Z�Q�Rk����L�H���2=$�\Ymhe_�qԇ�GM5�]���O�#�ߔI�/6՝��9<�6�;�.?Os��h�����C�#��rf��mo��[8_j��O��սC�T"I�(�Z��OjS��� C>��Ey�����f�a���;��{K�e��}(4(�`�C��v�.�4�!��ibɟ���x�A��w����KɺM��) ?w�Dxr�=�@�7 �W�i�!R�U�>�m��~,A�����2mDӒ�m�9����K|��.�5E�=
Static task
static1
Behavioral task
behavioral1
Sample
HwidSpoofer.exe
Resource
win10v2004-20231215-en
General
-
Target
HwidSpoofer.exe
-
Size
9.9MB
-
MD5
6164ece1262c3e9960ea20ce7c037540
-
SHA1
c8b74a7928f54858e7514b9b366cec916fccf8eb
-
SHA256
9dab33a81abd860186fa5e403eda50fed03ed6e0539024468ffbfab14c7cbc1c
-
SHA512
85f0ea4541feae2419236235e1d9f8dc6cd548dec919676e9e04b57c3b04291e5b9593e762bdc87462e2e44cc82947d091ba05fd123c3adb45ff06d81f03514c
-
SSDEEP
196608:XLA0H7q84eO+rA/FhJy+5pBKlKIwBsL9DEu1HIQNf7tNlrn1wwpFfVwxupYUI:XH7qE8/XkwpBKlioNh1XNxNx1w/MpYU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HwidSpoofer.exe
Files
-
HwidSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7.7MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 285KB - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE