OCSpoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

OCSpoofer.exe
Size

131KB
MD5

4c52a2a1b934c39f3b18d3719542cd8a
SHA1

c48d08088321d9b2b2d2e3c42f73d53a47169f4b
SHA256

231fc89309ebc255b28edef803f68c2fd1693639ec4164560fcbad4e68b57d75
SHA512

9f329d62e0a5c6806c3a48a5ca59d360d5e71f943e29361bc7d09391cb96f9f0c9f24514d9efe3f4398fa2b3eddbafa092cc9352af4b936e418ba6275d4a4b9c
SSDEEP

3072:UeCMT9szA4tOicW7t9m4WJjGwFQ8FKGtHqY:qlAiLcW7tBWJjvFQ8UGRq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OCSpoofer.exe

Files

OCSpoofer.exe
.exe windows:4 windows x86 arch:x86

Password: ss

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Legacy\Desktop\w\oc src\oc source\niggerspoofa\obj\Debug\OCSpoofer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ