Spoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Spoofer.exe
Size

516KB
MD5

dc2afe9b8b4c8608a25b35b15bf546c8
SHA1

f1f8ef762eb59f2caf586a7372714383f70f480e
SHA256

5290efbd2ffc53a6beb105f834a1d04876102762cafa0578a8f646136e777d46
SHA512

32d383af4fe13e1d0dbfcfb5279e251b72e9ff9e9c1e74a40682af50cff8aa29ea6b7757e0ec785fc85b7f47f9c6dc5a55d39c387ea05721ac41caea4ee03b28
SSDEEP

6144:6tuQd/KEPMf/JANn2MYjoWEYN4HrwTtALwoGfX4NrIFa+FDVjgpVv6bF7g:WuQ9KHSNdYjJa0o+4JcV0O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

Files

Spoofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Gta
Size: - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

. Ho
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g%1
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ