WF �������r�g*P��d= 0&�dAB>6(%�Vwob�m��G۹��}{�/���Q(���2��/q�7Lv{���e������>S+���}�UI$ �h5��NB�cD#��8L�ƃ@:���<H?��\�f���i�9�EH� �*�������f����}��̀mWi��%g=u���4 ��<i��^y�{%,;Z�r!����5���k�tB������j�o�}� p5�}��3��V�@�wBP�2{��l��+�2�� q�Y��6�Kt��̵u0�EF��4&�N��N�.���+�4�y����+�/�2X��^ ꝺ��S�9��� �Q�B����5����^����x���v�~R�^a�}��^C�7��*q�ŷ#�r�O�T�1����q�u�3���t�����ޚ`.zfI`㴿)y)4 d�Z�J���o�|%��������|++-Z:|7״Ϟ߳�R�m"!(=� ��+G?}w-��R�]*�Q/� ��s⿵;*�t뜤a�&ţ� �;)��P(�)�� :����(�J Z��Yt>f��0��2i���>ܮ;�[KńQb�+~����îzKu?�vG��j�cQ�.��z=�+�:@kj�V��_�83;(��)���:<���U�?y�W��>��ZU�&�eq2�O�<�]~��/��� *���l��a%#dޙ+h~���G���,#���?U1��];U�����;��%m��.�L.V�I�p�N ��;�����em\���հY��M�mփ�î�0�.Z?^���� ���|y�0�EO�YK�z(��SA��8"��h�-(�����������Kf��iQ�O����\�Ƚ������aJt��@�{⬾�װ6�z[}}�UK�����q����:D=Ρ��ņBF��B�|��%5y��]����k��2F��o�}���%n)F'��y4�w�%�� YֳA�e�H0��"���<A��&_P볘���'V} �Smo@���|3�D�|K�P���\�F���qa�����VL��+.��=�m�!Y�)=���M&S�Wș]K��k��t�����H;���./F����!^d��l���:����W����3�4bi����h?&����'_���vӞT�*Z�qR�t2&<S�� ��<��&$��,#�`�`3'I.ҌM�r6�"������C��� �L�� ���{w��0�����r���W's����)�^X�����$ ��_�&����槐��ǢH�̰jo����Nl�ڣ-� �/��)�w�͎�h!fߖ_�6N�a�?����_�XC|���B� �m�@�6�t�W�*�d�X�����^�\|V���=�}�Q�'�D�|`y끽��j�2��QY������q$��LX�nf����������%�Vܱ�;'5y�j.������jC�$B8�����m��-���<���6�l������a+����z���`��93J|%��̉x{t��L�,�F��O �u���+��x5�zK���K�9����ٹg5��wlv�kJȎs��۪= ��u��+7|zJ���v�� ���Ev�� ��[��@�V���)��x����d���8��|� q�Ő����ެ���T&�l1A���/�˵2O��w����p:���}�}�?B��ډn��ɧ�~��N\�kM�_g�j�f{�KO|��T@�?����D�����g)G�c,rt0�R�����?�˽� l�a93���O�>�}����k���?����SL�"r�P��Ԥغ%`zY����^;��u �~MS]ĬBb��ea�c5d��?ԙ{����R��X�$�>X_�0Q�Be��z���k�8��c��ʻ�H�5�� ��Js8�G|KD�0w�ƙ�؆�֤����k�ϩYPC��{!��|e��S`�%#/��w���yH�+�3ݹ��׳�!Ķ�Čʁ�u����q�j�5��n_��(1�O~��}P�O���~b2�Ƣ�+�^4kzRV.*_O�ūX3�u@R�_�7ֶ��_}��>P�1I� �H���T��Fʨ��O�C��P2��o�CIk�m�}��z]cr�{�G⢑��� ]���ր�q�*�o:s���g�_w9Z����N�Q��x$�ns+�<�e���şL�ar�&�]v�;ڼ��͜��_\f��.��l|�?� ��Ei1�g�s��G��T o���l�T$�X� ,��C�93;�?l��[æ�r��ep�� � 9�MG�Gz��wM>�z~Q�h��(��Fz̊m|A�9"(�,"���#O^/������'ɻ��6c��z� �I{�m�no��N+*/�C����'8)��L�?��4GBO�3(N���w��a�+ɤ[M��p�밌I����c.�(Ĕ��"f�����_��3�*H�ٿ��V�߀ t�F�Ga(T��iF��>|�K���[ �VA��E�j{,=c���H$����1c{R��/�6p��TZ���p@�oѿl��j�I� '��YS@ Ok!�<���F4i���4;�L��Ɛ-�F�_Bd{��ZRek�e��3�9�|���+�l���dy�H�U�wf�7j�$)�c0�fYA�E�&x���3f��)�����ͥ��0ʤ}���7��o�IK�պH�-��A��a�<{���������IOd�h3��F�_S����=s�����g?���ɸl��\>q<�%����cjY����o�!5��M�M������1�]�m��t-��ve�0��9>=��cC��6|��'����<J5%1�g�i�&(D�떕7Yp=�9^3|H��[�Mv&1&��d� ����/���;`��E�X����ye���- g>��1GGʡ������c�~i{�F�1e �{1�IJ6<V���4$��7k�`�H9��Br���/���Ju��ې2�������9i(�f&���I�����m5�-}m�tf���g?��*�^/��Hi��s]�w=B��:�bU�k�[0&?���b_�o��+�GG��ȧ[���
Static task
static1
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win10v2004-20240426-en
General
-
Target
Spoofer.exe
-
Size
14.1MB
-
MD5
dbcb1f83985b105d481ab7b8dc784523
-
SHA1
c760cc78bb1d2188b3fdb259914e4200e03beb91
-
SHA256
38f2ce0e8aabd50969730a7bf6a3549b2ba76c4fc9282b554b5aa9b1fac74fa1
-
SHA512
7a965611a7e7b4d7791e2f13e8a72f20d5bee83a1bafe78d746b0b2a7cdc058c90618ba96d1c3c5bd548bdb9d4e4cac3bd595b7524643f2947c0346d8a254694
-
SSDEEP
393216:zNKnRh1NhyRFCD/h04zDh9qlLhKJNGCRzIa:zNGh12RFCdBDhMlcNGCRz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Spoofer.exe
Files
-
Spoofer.exe.exe windows:6 windows x64 arch:x64
1d4637094882bdb69121fc986568f2e1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
OpenProcessToken
shell32
ShellExecuteA
msvcp140
?_Xbad_function_call@std@@YAXXZ
ntdll
NtClose
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertCloseStore
ws2_32
ntohl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-runtime-l1-1-0
_getpid
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
tolower
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 891KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Metro0 Size: - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Metro1 Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ