Overview
overview
3Static
static
3New folder...m1.vbs
windows7-x64
1New folder...m1.vbs
windows10-2004-x64
1New folder...in.vbs
windows7-x64
1New folder...in.vbs
windows10-2004-x64
1New folder...es.vbs
windows7-x64
1New folder...es.vbs
windows10-2004-x64
1New folder...er.vbs
windows7-x64
1New folder...er.vbs
windows10-2004-x64
1New folder...es.vbs
windows7-x64
1New folder...es.vbs
windows10-2004-x64
1New folder...fer.js
windows7-x64
1New folder...fer.js
windows10-2004-x64
1New folder...er.exe
windows7-x64
1New folder...er.exe
windows10-2004-x64
1New folder...st.exe
windows7-x64
1New folder...st.exe
windows10-2004-x64
1HWID Spoof...st.exe
windows7-x64
1HWID Spoof...st.exe
windows10-2004-x64
1New folder...er.exe
windows7-x64
1New folder...er.exe
windows10-2004-x64
1New folder...cs.dll
windows7-x64
1New folder...cs.dll
windows10-2004-x64
1New folder...st.exe
windows7-x64
1New folder...st.exe
windows10-2004-x64
1New folder...cs.dll
windows7-x64
1New folder...cs.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
New folder/WindowsFormsApp1/Form1.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
New folder/WindowsFormsApp1/Form1.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
New folder/WindowsFormsApp1/Main.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
New folder/WindowsFormsApp1/Main.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
New folder/WindowsFormsApp1/MyHWIDValues.vbs
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
New folder/WindowsFormsApp1/MyHWIDValues.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
New folder/WindowsFormsApp1/Properties/Resources.Designer.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
New folder/WindowsFormsApp1/Properties/Resources.Designer.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
New folder/WindowsFormsApp1/Properties/Resources.vbs
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
New folder/WindowsFormsApp1/Properties/Resources.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
New folder/WindowsFormsApp1/Spoofer.js
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
New folder/WindowsFormsApp1/Spoofer.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
HWID Spoofer GUI Test.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
HWID Spoofer GUI Test.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
New folder/WindowsFormsApp1/obj/Debug/HWID Spoofer.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
New folder/WindowsFormsApp1/obj/Debug/HWID Spoofer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
New folder/WindowsFormsApp1/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
New folder/WindowsFormsApp1/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
New folder/WindowsFormsApp1/obj/Release/HWID Spoofer GUI Test.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
New folder/WindowsFormsApp1/obj/Release/HWID Spoofer GUI Test.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
New folder/WindowsFormsApp1/obj/Release/TempPE/Properties.Resources.Designer.cs.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
New folder/WindowsFormsApp1/obj/Release/TempPE/Properties.Resources.Designer.cs.dll
Resource
win10v2004-20231215-en
General
-
Target
New_folder.rar
-
Size
622KB
-
MD5
0291f36cb0bc43e5244afaa2c8692633
-
SHA1
595be9a1db6d9a92478ce3628290391b241696a7
-
SHA256
bee7fd98e41723f9f195645a99c3a3b36e6ed789b6c56c7ff194b268c17eaa8d
-
SHA512
37aab9a5b9d629a5a9919f789d2b9be9e5e81eaa64a8221fdea82ab81e73c6b5ddd4a287313b71405254f8fe82a0141a749cdcbdaa6d60133710a1ca1cbed718
-
SSDEEP
12288:etCPzOea0nfINlyHPm8ybsH+r972b5FWmcyHQFYJrrcbq7O:LPzOAfINluPmVbZZ2XWmZH0YJrmuO
Malware Config
Signatures
-
Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.exe unpack001/New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.exe unpack002/HWID Spoofer GUI Test.exe unpack001/New folder/WindowsFormsApp1/obj/Debug/HWID Spoofer.exe unpack001/New folder/WindowsFormsApp1/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll unpack001/New folder/WindowsFormsApp1/obj/Release/HWID Spoofer GUI Test.exe unpack001/New folder/WindowsFormsApp1/obj/Release/TempPE/Properties.Resources.Designer.cs.dll
Files
-
New_folder.rar.rar
-
New folder/.gitattributes
-
New folder/.vs/WindowsFormsApp1/FileContentIndex/23718de4-524b-4a72-b3a0-cbc4e9da5414.vsidx
-
New folder/.vs/WindowsFormsApp1/FileContentIndex/41c819bf-2c10-4e97-aa31-39dbcbe1aaff.vsidx
-
New folder/.vs/WindowsFormsApp1/FileContentIndex/5b200d8b-deae-443c-b522-41801079729a.vsidx
-
New folder/.vs/WindowsFormsApp1/v16/.suo
-
New folder/.vs/WindowsFormsApp1/v17/.suo
-
New folder/README.md
-
New folder/WindowsFormsApp1.sln
-
New folder/WindowsFormsApp1/.vs/WindowsFormsApp1.csproj.dtbcache.json
-
New folder/WindowsFormsApp1/App.config
-
New folder/WindowsFormsApp1/Form1.Designer.cs
-
New folder/WindowsFormsApp1/Form1.cs
-
New folder/WindowsFormsApp1/Form1.resx.vbs
-
New folder/WindowsFormsApp1/Main.Designer.cs
-
New folder/WindowsFormsApp1/Main.cs
-
New folder/WindowsFormsApp1/Main.resx.vbs
-
New folder/WindowsFormsApp1/MyHWIDValues.Designer.cs
-
New folder/WindowsFormsApp1/MyHWIDValues.cs
-
New folder/WindowsFormsApp1/MyHWIDValues.resx.vbs
-
New folder/WindowsFormsApp1/Program.cs
-
New folder/WindowsFormsApp1/Properties/AssemblyInfo.cs
-
New folder/WindowsFormsApp1/Properties/Resources.Designer.cs.vbs
-
New folder/WindowsFormsApp1/Properties/Resources.resx.vbs
-
New folder/WindowsFormsApp1/Properties/Settings.Designer.cs
-
New folder/WindowsFormsApp1/Properties/Settings.settings
-
New folder/WindowsFormsApp1/Spoofer.cs.js
-
New folder/WindowsFormsApp1/WindowsFormsApp1.csproj
-
New folder/WindowsFormsApp1/app.manifest
-
New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.exe.config
-
New folder/WindowsFormsApp1/bin/Debug/HWID Spoofer.pdb
-
New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.exe.config
-
New folder/WindowsFormsApp1/bin/Release/HWID Spoofer GUI Test.pdb
-
New folder/WindowsFormsApp1/bin/Release/Release.rar.rar
-
HWID Spoofer GUI Test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
HWID Spoofer GUI Test.exe.config
-
New folder/WindowsFormsApp1/computer_pc_10894.ico
-
New folder/WindowsFormsApp1/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
-
New folder/WindowsFormsApp1/obj/Debug/DesignTimeResolveAssemblyReferences.cache
-
New folder/WindowsFormsApp1/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
-
New folder/WindowsFormsApp1/obj/Debug/HWID Spoofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/obj/Debug/HWID Spoofer.pdb
-
New folder/WindowsFormsApp1/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.Main.resources
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.MyHWIDValues.resources
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.Properties.Resources.resources
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.csproj.AssemblyReference.cache
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.csproj.CoreCompileInputs.cache
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.csproj.FileListAbsolute.txt
-
New folder/WindowsFormsApp1/obj/Debug/WindowsFormsApp1.csproj.GenerateResource.cache
-
New folder/WindowsFormsApp1/obj/Release/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
-
New folder/WindowsFormsApp1/obj/Release/DesignTimeResolveAssemblyReferences.cache
-
New folder/WindowsFormsApp1/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache
-
New folder/WindowsFormsApp1/obj/Release/HWID Spoofer GUI Test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/obj/Release/HWID Spoofer GUI Test.pdb
-
New folder/WindowsFormsApp1/obj/Release/TempPE/Properties.Resources.Designer.cs.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.Main.resources
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.MyHWIDValues.resources
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.csproj.AssemblyReference.cache
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.csproj.CoreCompileInputs.cache
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.csproj.FileListAbsolute.txt
-
New folder/WindowsFormsApp1/obj/Release/WindowsFormsApp1.csproj.GenerateResource.cache
-
New folder/WindowsFormsApp1/obj/Release/twangymoney.Form1.resources
-
New folder/WindowsFormsApp1/obj/Release/twangymoney.Properties.Resources.resources
-
New folder/WindowsFormsApp1/twang2.ico
-
New folder/img/backup_example.png.png
-
New folder/img/print1.png.png
-
New folder/img/print2.png.png