fivem-spoofer-click-main[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fivem-spoofer-click-main.zip
Size

5.5MB
MD5

86ffec9456d58c44524542f0bdf2d357
SHA1

61174679a1de85152fb1b4673429f50b45c5deff
SHA256

5864b7e83c81620d1c1a8c0c03e9b96a5069b9fda2d36c543083ffe9d0d54c69
SHA512

186f7ab86fae81bb6b8a2e1013b65ac0f4089d87a861641e6356d900fba9eda01f0efce25088fb87389a5df05be6872f08bd9329cdf1a0e9a33c27645ec6535b
SSDEEP

98304:TXXNw/8Ks31eOumNRpLyASjazeEd8ZRhoHVHE+0/weQpPofUiciWHyx6LT6d0:2/8KsleO/LtcwekHVk8pK1ctHoDy

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/fivem-spoofer-click-main/Wave Spoofer/Woofer_-_Hwid.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fivem-spoofer-click-main/Wave Spoofer/Woofer_-_Hwid.exe

Files

fivem-spoofer-click-main.zip
.zip
fivem-spoofer-click-main/Wave Spoofer/README.md
fivem-spoofer-click-main/Wave Spoofer/Woofer_-_Hwid.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 660B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ