Aorist_Spoofer[.]exe | Triage

Sharing

General

Target

Aorist_Spoofer.exe
Size

2.8MB
MD5

8b9e342f27976f4e576efb2f0b149127
SHA1

8d032b566fe1f693b1aa7eef83100f8647d1007b
SHA256

220d2b2baf5d77da834d069939b33fd70c57f345015f7dd83cdf6b0a82627bbd
SHA512

23ebb599c20601749a8252c00761dd916b2d44373f77e802631278677915a48fbec8db8333feed2ef9439c1d86300726f63de5a18cbaeb2d237ca24db10cb47b
SSDEEP

49152:tITYbNbNWo4kSH3OqtwIfrgBWBKH8jkDVFCNXODzWS9HfX0H:tIT4bNJFY3OqtY+KH4kpc+DX/0H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aorist_Spoofer.exe

Files

Aorist_Spoofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ