��K��1_��ߖs��Bs�y��c�Eƙ�YkѶ��J��etU���K�i6���.�0�(�]���OF�PNN�ܒ�z�g������2�R�WqQ����h����s�����z�Έ�q-��P��*P�T�&�;��IP0쭘� Hہ;knjWT7�PX$��ّ�!���:�~���l�����g�������� b[�~m����;��2���PUܘb�y�8e�n���o���C��������ϓʻ��3��=7��n���@�RT �^���2A�k��0���Z_ �f����@kJ��lTM�WOţ��&\Ն��Q�/g����/V+�.i�0BٍY`o��L�Ƈ�_V�����9�!�"y���>n�0�_*�H��p��Un�:�̐s)����wt ��5Q����D��1GUR�f(��ɐ�d��ݙSƎ�W�� `佽�%n�����[6^���WR[�NO��#b���w�D�[���k,����$�s˒2���D��ݺ�� ��Z�G:�C��U��(�H�[��-a�d���=��Ƨ^��ۜ�&�5a�����Pղ�����#�� �@�d��" ʷ�����>B����{M�ށ&���Z������U��wt�JP=�3@y|4duݤ�[�%������k4��bkHF��\F\)���$�?S��ȪA}pt�T~����ʨ{� ���m�a�7���S�����Ϫ��Zh�+�����b���]P�x*м�E�;[��MC�\8����e�:UL��~��-XL�5<;8_9��c��=�#UJ�;�-_��ֳr`U�n��`r����w�(C�qZ�1�y��A��QS.�0��jBT�e ��<�O<Q�����,b�f����L]�BF��f��9kp�����.��?�X�㍣�[��ܮ�X��_�<s��}��$6Kӗ�<`�P���t��|�4�<B�Vqע�\Hۥa���Y ��7�|�0͓?�^�ӹs@s��}����������,�+��GG���"?Og����3�p���##{������֦ �<g.�i!��Q�����a���}┹0�6�*���1m�'GK5�D��@��:R��[����NTJ�����M�8h�����*�?05���B���C|�sp�� ]D�'��|�{?y�� I�w�Zz�c��=P�{8I��h6Mz�;VY���|�q��G��e�Q,mHU�l�r'�Ͼ�#j����Ln=(7�%��"��U�]��j�7�w���Oi��FJ\|��Q�����&I�sqS3u�J܀�P+�j!Xd����}����#��3�u���<): ���PO#����iar�w�tJ�3vW�:bd�g6mȮdNk�W��㣟U�:�h�������!w�F��PB\��ȶ2��-p�W�F>����[�:�r��<������� �?�}��{0�������LSX��ec�zA�VYN}�t7�F�fe�9�IeHOf/-}rG.*Ct�Y(�[9<yT���Yh�q�&iD�ք4�Kt�L^.`�~���S]�/E�#�b��_��£� ��(/��7q�n�j�[��;��l/�dF}V)Dl+��f(���$+o�1�]f>��-L�Kb�4�\��2�_Zx�Aq5�c�d&���{��¿`QoTx��©�C�F�&�T����+g�8�Z��"��7��AF�� �7x����͓�"I*��P���s] c���:hl�8_I2��b@bF�������\Wf<q��ze5��?ʢ��XN� �K��Č�@����`�x��qA�-+�E}��Dm��n������ ���ږ�zpu����Q靭���3Q���� =(�d�1��ٝ`����m�2R�x�KĒC���?�|;oT� Z��eê�Z �c'H>�f 9~ 6S7�%�ę! 燵�s���¨����[}�S���N��j $��ڍ�L���4t��|+"������j����P�.A������7o�ҫa���nRq�o�@A뚡2��5>������D$B�e̱rn�L�F��?���%!�|�o͝=��!]�X�۠ <�g���M���b�<�ZP?����$�Sp%�M�����]i]Rg�$S U�ҏuv�W���g9Rg:�ջ{�`�+}r�����t��)�2���L�Qq��>(�B�㸆�?����pdX�����s͡b ��8�\i�#��v$m�͋y�v-N3�� r|�?q����Vy�r�라�u��ؠ��K$��T��#� �,^�8��fE��6�L�a�A�~����K�H� ��������^Dg�j��68 u]W���Vl�MlN���ڮ�\Q���e̻]�P>w7�ٟ�1�?*@})�(��������z��r�� �<��rV��]���g�M���kT=���%��ً�A�\�n��Fan��[P���z ���r)�q�.},��Ѷ� v�1�$����RI�,��സpHf� x��3w��[�(����m��������B�='����T�w D���U̖� �|��֛���a�{�����T>��~#0~�n#�{F5�nS}���k/��d!����$��+x�� � �pw�=n��UK�[P�s��@MR�*Z���i�=������3<�y����£YS_H;F�F��Z�ri�@J`�Ѯ������_�8���:��ޔͨ��H�]��ŵr�0&�E��-P���F�U�1�����S�7KL�X>�X}�|X��ȕF�c�z,*�J�~v� ���V���c�k����0K]-W� �t�N�\��rŁN��e[D�;6 �&�g,��P�Sހ3���!;���n�_w��6L����41q��S��Z� L:�'��(� L�ύ?�8\.��2����HfU��&:C�z[m�����w���8�w�s�fZ���v=�)�a�����ש���o�E�S4�U�H����p����$�[�J�O }��'U��T���3S������97�\��9��Â��k5�D C�Cm�������S픯� ��&U�eKA��8�T�� ����%�:IE���@
Static task
static1
Behavioral task
behavioral1
Sample
Palhacin_Spoofer_-_v1.1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Palhacin_Spoofer_-_v1.1.exe
Resource
win10v2004-20231215-en
General
-
Target
Palhacin_Spoofer_-_v1.1.exe
-
Size
13.7MB
-
MD5
d38aeed476d66120a826344eafcf72a9
-
SHA1
3b812847a3451673e95fbe89d0935120f96d676f
-
SHA256
2e83ee2cc34a205b2f91db83116ed67c4c0eb4bcba915f74edd1c1e203beb2ef
-
SHA512
a8de6c7b8ced31c635514af6a3f52c880a8c5dcbcd583a441c67a33d5fc13aef923e2a92f83fac5da09aafeaa9d2ddf60486d2e966511428544b6a197b2b81f3
-
SSDEEP
393216:ES8GkeuNgg/hb0GnTfYoXdMBStV9Oau0OrcO0:YMgpb0GTf1XwStV5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Palhacin_Spoofer_-_v1.1.exe
Files
-
Palhacin_Spoofer_-_v1.1.exe.exe windows:6 windows x64 arch:x64
Password: 121312bbielL
2ebf226287bfed2827f34a2b7141e90b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CopySid
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertCloseStore
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MHB Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ACk Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NQW Size: 13.5MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ