cb59fd75e408f87b07a5f0ec2310c3bc

Sharing

Copy URL

Twitter E-mail

General

Target

cb59fd75e408f87b07a5f0ec2310c3bc
Size

1.2MB
MD5

cb59fd75e408f87b07a5f0ec2310c3bc
SHA1

3056dcde685569333209e65e7987b5cc10fab7a3
SHA256

42b987c43ccd9e0c12b6bd311036de0f787cb2db67388d363c06d50a19eada87
SHA512

aa0fd972cfae455343bccb5fe6184f7ecccc254a88eb43e7a47cab510b575a4ad6922a1394f1a808f147c545b004f1b44191a90e8d44026467fd18f35cd4fc8b
SSDEEP

24576:yIQxZ7P31PqCCsLpIZuJDbJneCF4/qejWfXN8Ymdlfv50:ybfFSCCUZBFEqejWW/3C

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/spoofer 1/Hwid4.exe
unpack001/spoofer 2.exe

Files

cb59fd75e408f87b07a5f0ec2310c3bc
.rar
spoofer 1/1.PNG
.png
spoofer 1/2.PNG
.png
spoofer 1/3.PNG
.png
spoofer 1/Hwid4.exe
.exe windows:4 windows x86 arch:x86

caf305b68aad926d2599f8ceb251d421

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\SystemTool Eng 19\SystemTool Eng 16\SystemTool Eng 52\SystemTool\Release\SystemTool.pdb

Imports

kernel32

LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
LCMapStringA
SetHandleCount
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
HeapSize
TerminateProcess
GetFileType
SetStdHandle
HeapReAlloc
InterlockedExchange
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
GetTickCount
SetErrorMode
GetFileTime
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
WritePrivateProfileStringA
GetFullPathNameA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
SetLastError
MulDiv
GlobalAlloc
LocalFree
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
lstrcpynA
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
GetModuleFileNameA
GetTimeZoneInformation
SetTimeZoneInformation
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CopyFileA
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersion
DeviceIoControl
GetDriveTypeA
ReadFile
GetLogicalDrives
GetVolumeInformationA
FormatMessageA
InterlockedDecrement
MultiByteToWideChar
GetWindowsDirectoryA
GetTempPathA
FindFirstFileA
GetFileAttributesA
SetFileAttributesA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
CreateFileA
GetFileSize
SetFilePointer
WriteFile
CloseHandle
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcess
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetEnvironmentStringsW

user32

MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
GetSysColorBrush
DestroyMenu
SetWindowContextHelpId
MapDialogRect
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
EndPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetMenuState
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
GetParent
EnableWindow
SendMessageA
GetFocus
SetTimer
KillTimer
GetWindowRect
InvalidateRect
UnregisterClassA
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetForegroundWindow
UpdateWindow
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
SetWindowPos
OffsetRect
IntersectRect
GetWindowPlacement
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
RegisterClipboardFormatA
PostThreadMessageA
RemovePropA
CharUpperA
ExitWindowsEx
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
GetClientRect
LoadIconA
GetSystemMetrics
MessageBoxA
IsWindow
PtInRect
InflateRect
CopyRect
FillRect
FrameRect
GetDC
IsWindowVisible
GetCapture
SetCapture
LoadCursorA
ReleaseCapture
ReleaseDC
GetSysColor
CallWindowProcA
SetWindowLongA
GetComboBoxInfo
SystemParametersInfoA
EndDialog
GetNextDlgTabItem
BeginPaint

gdi32

GetRgnBox
GetMapMode
CreateSolidBrush
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
GetObjectA
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
CreateBitmap
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
GetTextColor
GetBkColor
CreateFontIndirectA
PtVisible

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

GetUserNameA
GetLengthSid
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegCloseKey
RegGetKeySecurity
RegOpenKeyExA
FreeSid
SetSecurityDescriptorDacl
RegQueryValueA
RegOpenKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
CopySid
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegSetKeySecurity
RegQueryInfoKeyA
RegEnumKeyA
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor

shell32

SHEmptyRecycleBinA
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ord17
_TrackMouseEvent
ImageList_Destroy

shlwapi

SHDeleteValueA
PathFindExtensionA
PathStripToRootA
PathIsUNCA
SHDeleteKeyA
PathFindFileNameA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal
CoTaskMemFree
CoInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
OleUninitialize
CoFreeUnusedLibraries
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CLSIDFromProgID
CoTaskMemAlloc
CoInitializeSecurity
StgCreateDocfileOnILockBytes
OleInitialize

oleaut32

SysAllocString
SysStringLen
SysFreeString
VariantInit
VariantCopy
VariantChangeType
VariantClear
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SafeArrayDestroy
OleCreateFontIndirect

wininet

DeleteUrlCacheEntry
FindCloseUrlCache
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA

iphlpapi

GetAdaptersInfo

rpcrt4

UuidFromStringW

Sections

.text
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 532KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
spoofer 2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\shopc\source\repos\free\free\obj\Debug\free.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

caf305b68aad926d2599f8ceb251d421

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

iphlpapi

rpcrt4

Sections

.text Size: 400KB - Virtual size: 399KB

.rdata Size: 448KB - Virtual size: 444KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 532KB - Virtual size: 528KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 400KB - Virtual size: 399KB

.rdata
Size: 448KB - Virtual size: 444KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 532KB - Virtual size: 528KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 12B