C:\Users\Windows\Desktop\fivemunban3.0\x64\Release\sc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SpooferUpdated.exe
Resource
win10-20240404-es
General
-
Target
SpooferUpdated.exe
-
Size
11.5MB
-
MD5
462d3a7dc4d67b65adc30b4c9040989b
-
SHA1
7a2200c5693c0e90fd3b0457abe0987f05089657
-
SHA256
94970233cdb345578fea420955d8ebf440d72139de751b8b2b1ad9d1712f285e
-
SHA512
c95611d5f45a6d0c8c29f0c44e857d2d7e2e83144bffd69eb85d1a68748f9d38fc31c25ab504d09aca60d72a72145596d56f10b828f457119b0d408ea4023df9
-
SSDEEP
196608:AXsAvDZZw4AnYs+ry/qyIbU6K6otsqASqTS5RBGovkAnllseYd1iE:AXsOZ9AnYdrEqyqJK6otLAfTURMjAnT1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SpooferUpdated.exe
Files
-
SpooferUpdated.exe.exe windows:6 windows x64 arch:x64
af8d7e96aa56bdbdb80baec829fec555
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateFileMappingW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCapture
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptCreateHash
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
msvcp140
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetNameStringA
ws2_32
recv
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
winhttp
WinHttpOpenRequest
ntdll
NtRaiseHardError
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
Exports
Exports
���vP%�m<��?v}_�3h�Ů_� #{\�� ��e�@�7�:�nv�2'v(<�:���[�-͵�+��-0�������B^J���]kCi�W��,# ��������P�YT��&�U~�ꇚ�5�����3��Ka|�i���8҄&���OC%���>*�g˵�> -����̈��e�7��.��3b�[�Ԇw5N�[蜗��xC-�� *�����U�3�Qb�!��O�t�B<z^-�Y麑u�^��$�.=���7�g�.��x���\ �-ۖ@��K5ɟ���>��/O8x����lr.��p�s��C݁}����sV �>�/�@�!��A����ى���� %���V�m�,��X[���}v�(�������|��L�?9��a��7�C����nј c����9O��ߺ�c�^�.�'��%9�Շ��Gг��q��������!�pq7��� *9r�{��+8&�y�ŭF�l�^vo�_��s m��Y�"(�z��9@>���J��۾٘�`,�-��Q��bI��.�O�ᣢFd��@8vf9�T��˪���d�Fk��r��8�����d�Ku���} �qR�ʳI4��'�m�%^�?�enB��k!�8 b���Q����nW����VW9�w4�n���S�A���pIcJJn�����:��Kp ؖ�d��ʚb�3M�\�4_Б��?�՞}�~��o�M��(^ �Q`Փ���Bxa�~� �g�ڬ_����Δ���]���=�!�19��Ƚ{�@�����)OΏ��:)�J)��N��8$ �d=' (�w@��VUR�X��>��)��������������^�pZt�*�������O-������L1�Kڸ�6ƻzl2�@2�vV�;14�*-Y��7��ǜ$���5�2Ugl� �oȕ7��T':\�������9,Mꆾn��v�R������G0L�nN%Ӹ����`�!fg˒-~�����LN#����H~ +��-� ,�_�utaWM��'E�R��qSߴ��$5�;ݽd��������aiP�R9:�I�}���G��>�%��FԨAP {j�Z���WRLj�+Sᄹn��'I�r��2"�3�l��)��̽��]�个�i4.}��G�f�^����@eQ�Rq+�O���:�N��8����=����t]�8�f����@Q�Qor�L�on�������P�Mlf� �R/p{4`]���Ⱥ�w��V#R�Q����d�Nm�d<G��0n͍d̗�v(-��ch�`��Q���M��:�����/�0U)�\�D��WϞ��NB0�)�Z��?���jdY[����*��k!������`�ED�\c���z�z}���g��F��ߖ�뽛��8���������쓺�ÜFj��7��c{�Va4��E<��@7� �+�ߴ���.~�y��v�+z]�I�u�O�ޡc�(L��?�>��N)��<$��A`N�A69Tz5��`ڡIV E�ɏٺߪ#�����l����y�����Ĝ���i�3�I���=5�s��͚� �Z�`���A#y �b�BT�����G?��P��P<`��A\"+��o���mk��W��Dz�B�;���+�@ L^;9��'|�zu�G��ʢ�a����Xw����~��E�XMs8�~2;Qe]�j�L�\+K"�xj���j�I�fc&\��͵Q??���|l����1Xœ}���.s2�ڸ`��]1����������I`+J,`�����Bv��#�Y�@������G�o4a� k�����W��=C���b�0�[^���>��Y �"��g�r���k^��B)�l@�3���=K���U��H=)�u�L��J���_u��g��G�s�r�`�\�7�S(r~��)��a����Ϝ�>M�s T����ʀU�����t����Bbk�<$��F��Mt�DE7[Ur �E��*�v-�X���2&s���O����`J�g��aOM�;�1�"����|�8�ϸ�b�D��~���T�DLn$��P��RMx<��W82̓1��x�����Ŏ|9�MS�l64Z'P �AzD��e�2���ۅ�\��-���h�^��V�Q�z\[2Nd;���%���s �a��ءˆ�;���#h`���p�@P!T�b���ca|��o�jw[�2n���t�pƖ.Bz����q�I �J?���%�4i��!����_�oP믠h �8%j)�5�b4�0>���n��u���$�4u��],M���i~}'�b�Z)M d�����^�W��1�;��:�`v`�5�.�P�YĚ&#)�4��X����i���#�\.�n.��j\(�*���V�����j�g[W�|K.��F���/�ve=����L��(��co߸/�^*ϔgh�����NA�/���o�-|��0�������@�l$s�f��C%|��C�ԑYxҝ%�'H�rSn�� ��V �A���J�����s��L����h��礳��f9����e�#fP����(P�n�2Q=�;0���'>s� &߾��=s:��/+u��L�a'nS�NN�a����?.=�$�u�'/�HkA7�.S�j�{Äd�h<"����Y\=rBb�y���Zk/��B�.s�`J�J��߷Y7Z�Po%��B',�ۧ�W��o�ֿ��� ,y5��v ���/�p�{:�㵭�,W6k�rG�Bp��~ �%�G� �����G&�+t¢�����ř:D��1�CF��R�*ݲ������]߽l�I�>.�:��~���@�0������� �|��5Y�*�0e#����װ�-lռ�s���|m������W��o��d�;�����R�Ұ'��m j��4/��%���OS��-�����2��İյIN6(a��c��B��/"˽��r\l�ϸb�uzLM�����u�Ԃ�����J��h���o��=Xc}F�;\�Jz��$��S.%s�2泀o�@-�ү��X���'�+��>h-����Z�7�S�m�f�-�5�~�R�#n������@��j��ď���>פ<�����f�f ��P�-�Ŏ��sA�X܀ʁ�\t>�{��u�l���.�5��M� ϸI�
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!4i Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.YT* Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
./@[ Size: 11.5MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ