spoof[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

spoof.exe
Size

1.8MB
MD5

f0d80de2cbae77122f67be9f3b3fd3df
SHA1

91b65fe03210e2fcafb14e8c48b043ad27e7bdd1
SHA256

78fe2fe5944eb6d9cfcbd6c683c22777dd52bfe3153499b4fb3e0f906c3cfd70
SHA512

7b77ccca6cf8d1dceb076a95e3d8dcd73f751d39cb62e81404f7b9bd9c27680a708894093d6db4f845e9389527e11c209c0d19512e7c413b58ce73f0176ec6dd
SSDEEP

49152:1SUsjvQbDFZQ+7XQnK+eqTWn0W2qylkIUF:1KjGDYcUK+eqT+0W2qyljUF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoof.exe

Files

spoof.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

PYS0
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PYS1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE