Static task
static1
Behavioral task
behavioral1
Sample
SPOOOFER.exe
Resource
win7-20240215-en
General
-
Target
SPOOOFER.exe
-
Size
5.5MB
-
MD5
20687a994db5b65bf85a2275df405738
-
SHA1
156d6667e31af35d779ec7eddd6a52e8e474e221
-
SHA256
d628cbac2b1c47b2ff852673439cbb68c663851649292e3dc80428b0a1c132dd
-
SHA512
cdcc7874036abc97080d433bc94649ae0b421763a17294adc2d1477aa7c7b56d4ec7ca6fa22d2e4ec260b4ad21ae033eac0a377cf0a62e18b9ce43b476686757
-
SSDEEP
98304:fTwcfFk3uf06h3N3VLYjnOEU5X/AtYZvI7Pl0Oi5R5Ddov:t9k3uf3N39YbOT5XFsipc
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SPOOOFER.exe
Files
-
SPOOOFER.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
pH}NDo Size: 475KB - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pH}NDo Size: 475KB - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kBHLjtmo Size: 512B - Virtual size: 22B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???? Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ