���|{�&N�inӖ�x���v��(A��-"���[b�=�%Ϛ����\g�-�-���:�:н;+9홽�%%���U��g$���O$G�F�|D�Xv���� %S�fs��N�"s�����{����o�=[�U�Hb�'O⺫y#K\��^@�Tv�� ��5�@����0�c$ϰ¿����{��O��������y� @3����W4��(����\ ���zt��k�%�o��[�~���6�������^��D�5�`��4G9�kǴ�� JQ �@țT��|�R��</�!QH��SL���&8��W�w�4*Y&G�t�e�e+|�ĥ�y8����S���N�NO�bzoc��d �0K�����!��FP�l&psd��8�Je���0;�-G�5�� V�� �/��d[���f���<М��������Hh�+�t�,_F�H|����9���e���^U�������kÏU����Β�������v�y*���+b4�i����"���i0��Nt�r���ܣ?�ŗ�Ry�v�XN����W*0�l��Δз%M9�� Kb_M��G���]H�\>k!��>� ���\G��q�w�o������p�C6����A����հ�����3_�X��C>������I�`��GB���?�\kA�|�<� y`3��*k�k�+��۞N V����ïzFϽ�1��R�#*fYu�OyË�4<n����y��!]� b&�a��S�#^ȫ§���Ok�(Mo ��n���=���&Q���II/�|����J����>@J����}2��]u?��� �Я�(�~��a�����9F��IG�:�^3<���w"��V��rt�B��}�� v�����kY9��C^_��i�-�H���Y�wu����,v����9�Vg�v�`Dyy�� �(�[8��!����9H*�K��yL!��%9�z�qKZg-�4�^=������q���(l%E��|���+:Q�3��K�p�wZb�M;d�����5��bPB]��"�+e�3�U�|Ѭ*|h]2ʸ�V����O�c�����k�SV������6Ǭ����� EBTҎo�)�$��/�|u� CU%��銂r���Gm��;As*�1�[�Wz�����N��ņ3����C�/��\�����gm��w15���y�82w�d2:�>c���&�9G�|p�{���u���Y��1�,�p�2Y}����}b{���<yS�)�[�&�Z����4ɬ(�L����k�CM��'��x�=B�Y���Y���ٷxd�@D�"% ]l�U����C,�m��T�=zIZ��g��c��H�:��$kafaq���B*'(47K�ͥ��8pIṆ�c��ɶL� k剱M$G͆�(v�wq�i�T"-l�rat����s��Ĩ)���������~��EF?�����Џ,�l�zetҝ�|�Йݰ�_���&�0�A�Kj��`�u�'�|f�l��G��_k^�U=H�����\�z�8�tpv���a´�4��Ԕ��VB�����V�|r jV�@�Ʀ�;P��.j�w!���0�G6���d̥��7b(�Vcm�qŷ�w�Y���;�<��(���O(�Yz�~��C~!��yU6���f*���2�� �Gŏ7�5��;4����8}��h�#����C1\Z~�:_A$|��&G٢�:��6��C�@܃���_���v:�줅�6�jqx�e|��^���D���� ��iS>��]IX~ui��$���)�a.U݂���¬�J�M?���aE��vGُ(ޅ�l��G����Kk�4����ɝ;�'��&��^���;�Xׁ��╅��z�9�F�%y�K�I���QZd�ʶߍ��kr�,$�����M+�[;uzG�("� �/G��C.K'b��������V`��'��ݍU=�;��ן�����~����on�H�=37\�K �t��Z1�ES ���>��$��yե��H[��^-��9h��(���k��ngc}���T�x�ݝdk�wZѱ ]��.�H��_����[�8��5�Oe�����AhA��t�)����Hʬe�g��n�V��sn��b:�87) �˹�n�Z'XF�D�����l�����T�?�e�͚$���ؔ�:*p��\��2�ww�1En�������D���yqܰ���R���f#�*3a���&k��1J���争��L0�u*:�-=I;✘�i��w�<���d��Lm�W%k3D^�c�YL��v?��R�n�������ٙ�C�O�c/�ُ��6Z��q�9d�rR�����b�zY/@O,J%�)~ S���~�Ns����7�~� 24���Y�g<g7+cA#��]�i�!A��n(#����-W��F�رX� ���Ѱ)�K����M��p���Fp&��L`\_B��L{��XΞǩA�Y?�N��_�gMH����f�=�� ҳ��/L$�5f�\ �N�c��^�^'\q���Th*�}����ۇ-�\g@';��B�Dz*��=|�"x?��a�eL �NQT����G���M��'ۤK�îiuY�eN��L�2�6���U,"l���XBy���1�w6����bǃAG Y"��&hW�����s�`_\^���z�k������Ք��-�4�4�+Lj6$���ɠ��P+re�r�+=]2��������Z���2�:3�*Et����B� /w��-Z� �+B$x���w�M-�nvm�K@�5'����>� �wo��t�p�c�������*��j�H�B��+����������9��E�4,� �)�L5��� �s��R5�'.�kg�˂���m��1��p�R6�p��6��X�˟0�S�"�8��Nߘ�ɛ����P[�@� .��� F��n��W��0ֈ�8�c��U �9���Vڄ�2'�����{��@�6�АQމ���I=0��£ hK��d/�E���aϚ9jF�M�@�(A�T�!���#�\ˁng�b���-� ���D
Static task
static1
Behavioral task
behavioral1
Sample
H&M - Spoofer.exe
Resource
win7-20231215-en
General
-
Target
H&M - Spoofer.exe
-
Size
5.6MB
-
MD5
da15d91458198def91317e7dfa40218f
-
SHA1
2195c46c742de12ba34ada4d0411025bdf06ceaa
-
SHA256
cc5c174606a90c09f56f7f00fe12e58cdca8168be09f5397438f96109fe04184
-
SHA512
974587e18c22d01d22ab8fe3dfb3b5177a137019a04a4f2a0d251356e2423415e6226747e6ffdaea5597c27627437f37635ca516ea90b2428b17be45bd73dc4b
-
SSDEEP
98304:ytC0sF/qRBXO4BL6YBUjeMx6WbaqSyvoXFCL9jNHX5wB4/r5MH7bYs2:Vq/XO4BL6YPFySyMCL/3aBCFMHfYs2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource H&M - Spoofer.exe
Files
-
H&M - Spoofer.exe.exe windows:6 windows x64 arch:x64
daa076736d65645d043c34c7d698a874
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
GetUserNameW
msvcp140
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.;u5 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.y\" Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,,U Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ