�j7xt���tm����h/Tg}����^��.�zPi~������G�iǮ��EL��O �DqQ�2���,�G,�����|8�'�+�V~Vr�'�=/W�YGr����*����`t���-� :�0��[}s�� ��D�B��~�[�DYA��{Xa�DŞ���,|�*TX��S=(�\�x���,� )�e%�Ȗ�M��Q���V�5]E"��D�%�n`d�|��ݸnek��6�3URN��Q ��̭x&]�U�y��FNf̩�JQykix�OZ+b��乹�F�]R0 (��=�1;�$ut��t�&r��^��w-Ra9�����WM��eBl����U)�� ހ�b�{�;��E���e�}8ypyj��0����#M���#ES�iy��d������Y���H�,C�k�s�3Br�s*k����V�H�95�؈���k/b��%��vۅ��x��Q7|�5�1����$�qkB���?^��G6-(�2�a���(u�+V��کi�&�/1WL�X����4V>1(4T>�i�q��G��a]���ⶹ�C5Ψ����b�a%�OB�:���ֽ�K�W�E��VN�Vc�Z �0�0y�q�:I�6���pFҳ�.L���-�B�|�?3��R'�R�V��6�q������J\bѹ�����$�{��5hw�Rz��I�6H�Y{�����;tv�5 �ae +Jn��L�5iEѕ����d��R�6���2��Q{�$G�38@4���Ο�<$ ԇko�K�7�T3���ٖ��y���G_�CY�VQ�'��e�N1Qk�������K/3st7��H�����A7�1����4��=��R?��s5�Ա�=HL��0�M2���K�B̫��f4�����ؘw�F-K�6�q���ޘ�!���mB�<�}U����}�����af#_�O���h���f�-�K�����qۮJ��k��N Щ�yhq�A�2sψ4��t��C�.��0���:Qq�3x��B9g�)��թb�w6B�if<Hfeg��^ƪ��q1�s��_�ô�]~�Sj0��/7���2� !fT>!R&xp3�s��k��վp���~���'mp�W1��6Ue��X�T�&H�� R��$uC�>����W�ŰU!훼Ѧ$�R?.��J�sZ�Or�歉"z9��8������#>�6���XJ��J8�wX�!c `�#�F�Uƈ�MP��Ra� �<B׃X������Nŏ�We/�6���IQ��I��bB��ύ�ݽ��}f�n��bm C�+Pۻ��E����Z���b��t�fL����M�L�i?L��(��.#�,�W/�|�Y �,�l%LA�bRc��qG�{u���{܆��(ɲ��}�ϕ8��lw͂Z��[�mA���͗��_3�f c�}��*⬃��m���Z���Sн�sM�N��£v�<z�{.�����xlS*8���A�9�s�u�!G2�����μJ�|���⾎����O��� ��|M�;�fRe������/\+�ȇ�x$�I��7X�-? Dp�ű�\����.��~3R�X�����r}TEBeb��L�����\�s��r��n�?&~ ``lC��"E���3�e��C_4����N���d�5T-��^a���p�<suK7վ�V���h щqtU����[�3�֑���i7�ǞO�ٝP�en�,A�����"'���Α���F{�>�7e�P,g�N���a���z7w6��m���8fL�'��6q�8�*�l��~��Ls��*t߱\ז����Bܶ��}�Rp���r"���`��:ˌW,�����K��K���Rf��V��8:[���������S˜��^h�۪3��v(L ���] >����'BWx�%;�����콓�N��%�$��@�o���� ���7�F� Bqb�9c�:��$�7W��[;QdzԷEڬl�%T�ܡ����yI S�6QJ�U&����+���j�:&kW��C�W����t����sĪXSx�������̔<�k�����,�y}�It:k,�<��p'�_�� ��\Ox���Y���9���4}yd���!ԙ3�#����R�)t���n������jH���"ʹBF�����e�?�P�`�._���E���=��(��'����&�J���ZөR��Ti��}ܵg8�M�Vu+��66�� Qc�@�>��_ �;a��r[@�K�F�Bp�:�}O�"��iE~=�����e��,�:&�Zm�Pc?�J�+N8}#�����+PԃwhW��f�:�?���q� |���D�u��Tw!�Gl`Pw���o��Rէ�������z��K~)��?l�����H[m�t�0�@�3�}�Ũ�v��<��R�>.�@^����Z�bL)*�5��WABt ushv���]�������7�*{K��Xe�"K�f"Ϊ�#�T��ۛ�du�5�M���JU�j;����������q)���.Ls��3bM���f�(��9�����,n�`����!a*�����i�-�R��2�i�8�-h��YAraR��H��W��:��-��]�-W�D�P` 5���:k���-��TJغzc!]�����S갃�b`}1�"����'�̃����GJ�Z��k�&��r�EB�Tm�,'�p�E'�̆��z��1���(z�������a�w��p�n�_ݜ�P��eU��?�D��k� ���z&yN������\����FLP!g��N�K���D'l�n$Σb��#�ؔ;wğ��A.yf�7�����r6������^������$�F�||)�������VĚ������ɹ3�s7��s!��/�d N��w��@ �Z�ku$�q�G)�&�-F�n���ഩT�2hޗQ�>[me+/9}k��PA�Tt.�Mckz�,�>����+L�%�� ����f�3|���:iB���>_��>#�(�f{/��UzV}MM���)^�e����I�/I>,���tr��_��/=�cYX�֛����Q�1��c����t��f��k5.�p�������H���;/.Md~����5���=/�:D��cl �O�9Ũ ��̂��U��3�� p ȶ2�%�Fv4]<D�����k3~�G+3J�gћ�F��p,�כ/���0�w������j��w��u� 23�lfb���Ӏ�����4��`��5�:���xh���~����R+�4~�#��5�eU-\)`[���6k��G�������4��l�IϜ�V��G�6�O��;�|���6�2R�)0ZN��;�ۻq5�6�~e�����[s�����pͫ i���[����ֶF�e�A,g�%l�i�k ��`D3�w�ev5?��d+B��a���A�~�x��������.�����2�Ij��=�x��6H�jn�]��ԅ��pd �e[
Static task
static1
General
-
Target
HwidSpoofer.exe
-
Size
8.9MB
-
MD5
6df1920ead88774763f88102f7e54253
-
SHA1
8d55f0c1ae0b2007f5b86f22465d66651cc6fa7c
-
SHA256
5cdc87cde9db0c716c54d85011f62b6209092e801b97e636f6fb092e9e763073
-
SHA512
ccc654a02d4b8787ef1a6739a6673b0d269b46836d1ac6688834611c573fcf5c6cc83d2c313402cd496c446c13e8461647c30946ee7ec5f20f9fa5657ae11f87
-
SSDEEP
196608:uHcoGACm2KIdGm93KOBotH5S1Vcvwo8S07rOH78Dnm:ofGxm7IMm93KEVgwW07Sb6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HwidSpoofer.exe
Files
-
HwidSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 6.6MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 285KB - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE