C:\Users\NeverKillMe\source\repos\FiveM-Spoofer\Debug\FiveM-Spoofer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Resource
win10v2004-20231222-en
General
-
Target
2fc7bb2573febdedec39b547da83a64d.bin
-
Size
466KB
-
MD5
a2fe8dcae0fe61535c1af51d5d2ad5b2
-
SHA1
4985f4a5b5f51ddf0a11f07befc9847f0e66f305
-
SHA256
353bff15a8b764da261abb7076d0703851e33fcd2056172dc7361f660f1be5f9
-
SHA512
c6df401664072f5529dcb58bbbce9d3f1e26f6b5f9209c52afba37739cdd0b6af10bfbdfab5c38706a20c3494a61fc9b340b10ed3e60e61bebdd7cc61c6cff2f
-
SSDEEP
12288:iZJNPRtua+GSlqTR+CmjllQwbI6AbCh4sVCtLO9rgBM:kdPSlCw4wbkbL+CpO1iM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe
Files
-
2fc7bb2573febdedec39b547da83a64d.bin.zip
Password: infected
-
74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276.exe.exe windows:6 windows x86 arch:x86
Password: infected
ba66dcfc08cd15877a60d0a57560fd16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetStdHandle
Sleep
WideCharToMultiByte
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
SetConsoleTitleA
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateProcessW
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetFileTime
GetTempPathW
AreFileApisANSI
CloseHandle
GetLastError
CopyFileW
CreateHardLinkW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
GetCurrentProcessId
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetModuleFileNameW
LoadLibraryExW
HeapValidate
GetSystemInfo
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
DeleteFileW
MoveFileExW
ExitProcess
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapReAlloc
HeapSize
HeapQueryInformation
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
WaitForSingleObject
GetExitCodeProcess
shell32
ShellExecuteA
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
oleaut32
CreateErrorInfo
GetErrorInfo
VariantInit
VariantChangeType
SetErrorInfo
VariantClear
SysStringLen
SysFreeString
SysAllocString
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
Sections
.textbss Size: - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ