��K��1_��ߖs��Bs�y��c�Eƙ�YkѶ��J��etU���K�i6���.�0�(�]���OF�PNN�ܒ�z�g������2�R�WqQ����h����s�����z�Έ�q-��P��*P�T�&�;��IP0쭘� Hہ;knjWT7�PX$��ّ�!���:�~���l�����g�������� b[�~m����;��2���PUܘb�y�8e�n���o���C��������ϓʻ��3��=7��n���@�RT �^���2A�k��0���Z_ �f����@kJ��lTM�WOţ��&\Ն��Q�/g����/V+�.i�0BٍY`o��L�Ƈ�_V�����9�!�"y���>n�0�_*�H��p��Un�:�̐s)����wt ��5Q����D��1GUR�f(��ɐ�d��ݙSƎ�W�� `佽�%n�����[6^���WR[�NO��#b���w�D�[���k,����$�s˒2���D��ݺ�� ��Z�G:�C��U��(�H�[��-a�d���=��Ƨ^��ۜ�&�5a�����Pղ�����#�� �@�d��" ʷ�����>B����{M�ށ&���Z������U��wt�JP=�3@y|4duݤ�[�%������k4��bkHF��\F\)���$�?S��ȪA}pt�T~����ʨ{� ���m�a�7���S�����Ϫ��Zh�+�����b���]P�x*м�E�;[��MC�\8����e�:UL��~��-XL�5<;8_9��c��=�#UJ�;�-_��ֳr`U�n��`r����w�(C�qZ�1�y��A��QS.�0��jBT�e ��<�O<Q�����,b�f����L]�BF��f��9kp�����.��?�X�㍣�[��ܮ�X��_�<s��}��$6Kӗ�<`�P���t��|�4�<B�Vqע�\Hۥa���Y ��7�|�0͓?�^�ӹs@s��}����������,�+��GG���"?Og����3�p���##{������֦ �<g.�i!��Q�����a���}┹0�6�*���1m�'GK5�D��@��:R��[����NTJ�����M�8h�����*�?05���B���C|�sp�� ]D�'��|�{?y�� I�w�Zz�c��=P�{8I��h6Mz�;VY���|�q��G��e�Q,mHU�l�r'�Ͼ�#j����Ln=(7�%��"��U�]��j�7�w���Oi��FJ\|��Q�����&I�sqS3u�J܀�P+�j!Xd����}����#��3�u���<): ���PO#����iar�w�tJ�3vW�:bd�g6mȮdNk�W��㣟U�:�h�������!w�F��PB\��ȶ2��-p�W�F>����[�:�r��<������� �?�}��{0�������LSX��ec�zA�VYN}�t7�F�fe�9�IeHOf/-}rG.*Ct�Y(�[9<yT���Yh�q�&iD�ք4�Kt�L^.`�~���S]�/E�#�b��_��£� ��(/��7q�n�j�[��;��l/�dF}V)Dl+��f(���$+o�1�]f>��-L�Kb�4�\��2�_Zx�Aq5�c�d&���{��¿`QoTx��©�C�F�&�T����+g�8�Z��"��7��AF�� �7x����͓�"I*��P���s] c���:hl�8_I2��b@bF�������\Wf<q��ze5��?ʢ��XN� �K��Č�@����`�x��qA�-+�E}��Dm��n������ ���ږ�zpu����Q靭���3Q���� =(�d�1��ٝ`����m�2R�x�KĒC���?�|;oT� Z��eê�Z �c'H>�f 9~ 6S7�%�ę! 燵�s���¨����[}�S���N��j $��ڍ�L���4t��|+"������j����P�.A������7o�ҫa���nRq�o�@A뚡2��5>������D$B�e̱rn�L�F��?���%!�|�o͝=��!]�X�۠ <�g���M���b�<�ZP?����$�Sp%�M�����]i]Rg�$S U�ҏuv�W���g9Rg:�ջ{�`�+}r�����t��)�2���L�Qq��>(�B�㸆�?����pdX�����s͡b ��8�\i�#��v$m�͋y�v-N3�� r|�?q����Vy�r�라�u��ؠ��K$��T��#� �,^�8��fE��6�L�a�A�~����K�H� ��������^Dg�j��68 u]W���Vl�MlN���ڮ�\Q���e̻]�P>w7�ٟ�1�?*@})�(��������z��r�� �<��rV��]���g�M���kT=���%��ً�A�\�n��Fan��[P���z ���r)�q�.},��Ѷ� v�1�$����RI�,��സpHf� x��3w��[�(����m��������B�='����T�w D���U̖� �|��֛���a�{�����T>��~#0~�n#�{F5�nS}���k/��d!����$��+x�� � �pw�=n��UK�[P�s��@MR�*Z���i�=������3<�y����£YS_H;F�F��Z�ri�@J`�Ѯ������_�8���:��ޔͨ��H�]��ŵr�0&�E��-P���F�U�1�����S�7KL�X>�X}�|X��ȕF�c�z,*�J�~v� ���V���c�k����0K]-W� �t�N�\��rŁN��e[D�;6 �&�g,��P�Sހ3���!;���n�_w��6L����41q��S��Z� L:�'��(� L�ύ?�8\.��2����HfU��&:C�z[m�����w���8�w�s�fZ���v=�)�a�����ש���o�E�S4�U�H����p����$�[�J�O }��'U��T���3S������97�\��9��Â��k5�D C�Cm�������S픯� ��&U�eKA��8�T�� ����%�:IE���@
Static task
static1
Behavioral task
behavioral1
Sample
albins.zip
Resource
win10v2004-20231215-en
General
-
Target
albins.zip
-
Size
23.5MB
-
MD5
8faf7fe44105791f1f7e072b34899e35
-
SHA1
c1c2b531ea4303e152762d525057dd31c6260f3c
-
SHA256
8ca06585a8f82b6042704a31c4f76b3efaca13bb070aaa93fc4626d8e8e08930
-
SHA512
aa1b88935056f4cfaed189b990b77179386462bed4954a006c056eadbc590c65d18a5ce12252e6a777ad8d1c444d4f0f217d8db40d9313d739c9e4a4d5eff3e6
-
SSDEEP
393216:Ssi6s+YTQunF5sePDZOKDTadGJxplLZ2yriQiPQCNhtP7gNUZryqxTVNcgdwhePX:8QuF5sebZ5D8GJxB2yriQZ8ryqHehePX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/albins/Ppoze_Spoofer_-_v1.1.exe
Files
-
albins.zip.zip
-
albins/Ppoze_Spoofer_-_v1.1.exe.exe windows:6 windows x64 arch:x64
2ebf226287bfed2827f34a2b7141e90b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CopySid
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertCloseStore
ws2_32
bind
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MHB Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ACk Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NQW Size: 13.5MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
albins/Process_Hacker_-_Undetected.exe.exe windows:5 windows x86 arch:x86
Code Sign
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29-06-2019 20:37Not After31-12-2039 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29-06-2019 20:37Not After31-12-2039 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Signer
Actual PE Digest93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Digest Algorithmsha256PE Digest Matchestruee3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cSigner
Actual PE Digeste3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 163KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.38rlqw Size: 7B - Virtual size: 7B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zoi1JH Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE