��œ�q��|=�d)��T�3�|X:Y���"*��.+'���k�y�����\��IzMVi�5������(CjQz"G'��0<������j��b��i��[�7�UGר��;���)���ź����.F�f�w,/T��W�CdiJ� �������i�k0�$��tH�a�E�!E;��� �u֢�}��(cZ�[cce��5�1ڵ�t`UЩ�evQ����L@�e�"���Ȁ��<������M�7�p�!Hk�8�[G��[��OX��Yi�N����ʠ@W���3:=$�%����5����?_�j+��j���*.$a���Ml�U� �u���8l ۦw��nPmKyRN�8�ڱ��-s>X�Z)����W��O��CƝ#U`��L��>b�����U��W�!�]L���I�\�qrI9���4c��d���><!�&�w��K�c>�P�B43!p�'�uE;�a�l&r�~>gh�[�ht4sQª^�������Z`�Փ�����4� u<�K�uff)'����ͻH�`�z�PX�5Ѭ����.��um4Ro-���I��w牝؇|ŭ$���4�R��(,YO@z���֘��l����%H���;+�X{D+F�)Kl!!ug 0\��* ����]h�Y��1� �I����l���)��7�Z�7$Z�I)էj��fa!k��i��i5h�?��������s[�<��B"7�D���sN�IU�^��,�R��d@�O���ޣ_�Ԛ��h�"���a1�\�R0ܘЁdp}�"��͎�r)f��@ѾU���G��W�?x�IAZz^�/.�{+�D3��x��n0�ts4�^a��¯ł�G �k��ns;n�����h^'G�=���+8� pUF�RD����[��:�*��b���Ɍ��rgu�T�,����Z~n���#Y/�8��^��_GY:CxFN�루�M���%�B���k�#��lį�D���`�Dyz�J`�4(��>��Lj��)U���X���?�I����2�0�w�W��5�5a�-��ˇʌd%0?�M�*�-՛�Ѹpe��:$K�u��H�|Q��@l�~˗s��Z���"1����\�;��UՕ���Z�d��� 8@���,@�ae���ve��έ�hH�9d�> �l'mI�S5�i�I�+x-oIe�� ���/'o6$�.+{�?����%�`LL�$u��������*�:�|(������X����s�q��^�\_f������)�]0.ht��?y`�N�L3���C"�+MF�ޔ���a4E�!���^:G~|�ls-�W9p(u����ܐYUr�"L�&����j*F �(�����Mr�~B���ojNs�C��ڝ[���!��I�"�g��X��['QO�.Cf]�Z�zq�T0���� �5$x����{��Kp!��0�+R�� �&�)g@c,�B��Ai��:���(8{�����)p��(���Iɥ��>��%T�5?%:r��H�F�2�d�m$d��g�����E��G�2=*���y}RS��*Ք2�+���� �\o������@'��y�i"�h�������!\Xiw� x�[m6#�s��=�?�U���vq��C)�uJt���8��;%k��^z��~�u�3a�~���Ƹb-o�3�-���Ɓ�a�����BC7�/�a~���jJs����_�h�#q���G�����v�Nez�kz%�2咠�oH�O��s�6�[P�.-�����V�o���Gz�$+^�2�-+���dfQDF��ɶmUjS|�����,�!*X �k-]�:�G� �s� ��c �1bG�q]��pwSZo� ��Ѝ�,=w�������mL:�ͩ_��p"�πM�jX<;� ��7�8��F�^s�F��Zu�ìu�ޅ���&�m%ߟ�T��&JX����Vz,�p?t.S�~c���@[W���:����U�]�W_���葭����!~r[y$�_z�*��\;��Q��_���k�H`��x|��"�8�4���Y1�D�����~Q]�0GT�4��Qt�� �WQ������P��|����t�o�BXh^K��ϭʝBV�s, <M�ͧ��ie�9���t6X�c��"98�ʢ�7��(M=!�RfyC��#pA+�V�ݯm�%Y����$��':� 1܂8X��ڂ��H`����UK�B�DC�A���;)KP"�*��o3۫s�2�C/�+��04�M��q[�V���� Ԇ�||��N�/��Z�A�.�@��{��ǵ%� @�$�S��X�3i~��J����v��&*�\bd�XZKd��z,��g��e����j�qvf/d^��ͩe��Z��GXK9���^]+aYIᳮY� ؾ%op�?=�$�/1��"%�*FP�]tĦ�r�-�[X�PGa�E��3Bbjq�6����:�yQ�q�x��`B��ƛ� .N콼l����������*˻x��:D,�!�!�c�#q/�� ߑE���? ��!��/+ӏ�:�NU4x�c�=en��� a�k}�{M�����[.,aQl[�F ]����ђ�ֶ�� �\9����Aڀ:�ZYG�d��[�{�� yXV�ydˮ�#{i�nQzz3���1a|i��U�}��c�!�f���Zr��5*OX������@�NF�>)�}lIj����c��`U�'����c������|M&�S�[j7]_N����)~��+�f�:�d�ЛϲS�����2D t�'��J�,q�.�Z�!�"�s:�ꇗf�ڻpnd�̮W�^&�� ���B�(��>3����n� �kl���:{����)6��G?��s�'N��ĉ����$���f�&��=�6��E�OR�G��i@��)T��� �.�3�6��X�e�U��^VD���Xc�=������Y�}�De���R���u��2"Ɗ����v7�*�i����{�P���"��zڜ��/���$������������F���z_���L���A4��X�v�X���$`����@�d8�ĩ���k :��/O� kv� ��<*Y'�j�=���n`��+6�:��Λrpڊ���yU�.����o�.�D�e~#Y ,���x�f�e ���P�9�i$�k�f��d�B�:ۜ��i_�P������� Gq��}�5K�����������T�y�6�Sc)�N�\s}��r�c&���>�-�?8k5�� ?h$��BJVzP��F��]r�)t� dr;*�ҤQ�1U���8���FJ���S^���?]�gq�����d��a�zVatD���K���5_\���J{/���X�D��I�f X���3��Μ�d|GY������ި$���c�3���g���������l�e �I��G���ϝ#��P�^ ����������oB���~�R����`;�Y��B3n�7�-�c��LPo9������L���Ct�WWx�U��g�:TɵLrM����T4�YE�������D���EX`�b!��>�
Static task
static1
Behavioral task
behavioral1
Sample
HwidSpoofer.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
HwidSpoofer.exe
Resource
win10v2004-20240426-en
General
-
Target
HwidSpoofer.exe
-
Size
10.6MB
-
MD5
c670b482a6d6711e46787a6cc0a91e95
-
SHA1
9001ea885da8fe169b068be0b64e899f5bbf8442
-
SHA256
673a61d3d4a00fccd78130e6e7cfec4d1d8915551cb9849ab5924c0579767fdf
-
SHA512
90720d4f9a6ea320ab371874591bb600a0615837bc8bb8b1fa8a7209401ba3e4b5aa7e8c1531e3a07e39866b8734ec9226126a77cd398390f89878bb8d614fb2
-
SSDEEP
196608:aihaghqnW2BNhxtCHSrgFdI5b//jxKB2LysYrO7W4yhxdOGv8i:FphR2BLjwq5b/jxKB2LXYrO7OPdOE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HwidSpoofer.exe
Files
-
HwidSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 274KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE