C:\Users\NeverKillMe\source\repos\FiveM-Spoofer\Debug\FiveM-Spoofer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Resource
win10v2004-20231215-en
General
-
Target
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
-
Size
1.7MB
-
MD5
2fc7bb2573febdedec39b547da83a64d
-
SHA1
49d165527598a6de077a213432441078124f5e02
-
SHA256
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276
-
SHA512
911792aaa8dfa20f29b6589c1aceb04e367336dde504508c25676f9b1ecf0e18b69652b955e6fbd038f207ca1dfd81e41c935c131209a4daa4b931c99e9f6b46
-
SSDEEP
24576:8bG7JuDRDTyjIFDEb+Wq5iKjV2eUQUDHvEYw:8bjQjI2bOP2xQUzQ
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Files
-
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe.exe windows:6 windows x86 arch:x86
ba66dcfc08cd15877a60d0a57560fd16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetStdHandle
Sleep
WideCharToMultiByte
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
SetConsoleTitleA
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateProcessW
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetFileTime
GetTempPathW
AreFileApisANSI
CloseHandle
GetLastError
CopyFileW
CreateHardLinkW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
GetCurrentProcessId
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetModuleFileNameW
LoadLibraryExW
HeapValidate
GetSystemInfo
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
DeleteFileW
MoveFileExW
ExitProcess
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapReAlloc
HeapSize
HeapQueryInformation
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
WaitForSingleObject
GetExitCodeProcess
shell32
ShellExecuteA
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
oleaut32
CreateErrorInfo
GetErrorInfo
VariantInit
VariantChangeType
SetErrorInfo
VariantClear
SysStringLen
SysFreeString
SysAllocString
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
Sections
.textbss Size: - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ