C:\Users\System69\Desktop\spoofer\project\example_win32_directx11\Release\spoofer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PI_spoofer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PI_spoofer.exe
Resource
win10v2004-20240426-en
General
-
Target
PI_spoofer.exe
-
Size
1.6MB
-
MD5
fc1e92b2bac647bccf8f90765dd13b00
-
SHA1
f59478e2bce968f177bf1a08be6b50dfdb69f6cb
-
SHA256
edeebf57d60c2ac849c4da3596952131332f3b1a9fa35494b2b23698945ef615
-
SHA512
2ede970fc4febc1d9c79104447abb793c3b178fdbd7640412840e58d9881662b32d811c571f53e73b59bc086c0fc0ae56cd38c73c053ad802925159f1ecfe5d7
-
SSDEEP
49152:kh1KzC5tAOZXUnwix/qvLnw0RzELXDZP:kh4p/EZRAXVP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PI_spoofer.exe
Files
-
PI_spoofer.exe.exe windows:6 windows x64 arch:x64
dcf7ef41ebac0904758e4d3fada0b836
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
QueryPerformanceCounter
HeapFree
GetCurrentProcess
InitializeCriticalSectionEx
HeapSize
Sleep
GetLastError
DeleteFileA
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
RtlCaptureContext
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
GlobalAlloc
GetLocaleInfoA
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
InitializeSListHead
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
FindNextFileW
LoadLibraryA
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
GlobalUnlock
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
OutputDebugStringW
TerminateProcess
user32
SetClipboardData
ReleaseCapture
GetWindowLongW
DefWindowProcW
CloseClipboard
GetWindowRect
DestroyWindow
CreateWindowExW
OpenClipboard
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
SetWindowLongA
PeekMessageW
MessageBoxA
MoveWindow
SetLayeredWindowAttributes
TranslateMessage
IsWindowUnicode
SetCursorPos
GetSystemMetrics
GetKeyState
GetClientRect
SetCursor
EmptyClipboard
SetCapture
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
GetClipboardData
TrackMouseEvent
ClientToScreen
GetCapture
GetCursorPos
ScreenToClient
GetMessageExtraInfo
UpdateWindow
PostQuitMessage
LoadIconW
advapi32
CopySid
IsValidSid
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
GetTokenInformation
GetUserNameA
shell32
ShellExecuteA
jsoncpp
?write@FastWriter@Json@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@2@@Z
??0FastWriter@Json@@QEAA@XZ
?append@Value@Json@@QEAAAEAV12@AEBV12@@Z
??AValue@Json@@QEAAAEAV01@PEBD@Z
??4Value@Json@@QEAAAEAV01@AEBV01@@Z
??4Value@Json@@QEAAAEAV01@$$QEAV01@@Z
??1Writer@Json@@UEAA@XZ
??0Value@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Value@Json@@QEAA@PEBD@Z
??0Value@Json@@QEAA@H@Z
??0Value@Json@@QEAA@W4ValueType@1@@Z
??1Value@Json@@QEAA@XZ
libcurl
curl_easy_perform
curl_easy_getinfo
curl_easy_init
curl_slist_append
curl_slist_free_all
curl_easy_cleanup
curl_easy_setopt
curl_easy_strerror
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Query_perf_counter
_Thrd_join
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__RTDynamicCast
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
memcmp
memchr
memset
memcpy
strrchr
memmove
__std_type_info_name
_purecall
__std_type_info_compare
__C_specific_handler
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
longjmp
api-ms-win-crt-stdio-l1-1-0
fflush
fsetpos
__acrt_iob_func
__p__commode
ungetc
fclose
_popen
fseek
setvbuf
_get_stream_buffer_pointers
fgetpos
_set_fmode
fgets
__stdio_common_vsscanf
fopen
fread
fgetc
_pclose
__stdio_common_vfprintf
ftell
__stdio_common_vsprintf
fwrite
fputc
_fseeki64
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
strncmp
api-ms-win-crt-heap-l1-1-0
_recalloc
_aligned_malloc
_aligned_free
_callnewh
_set_new_mode
calloc
free
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_beginthreadex
_invalid_parameter_noinfo
abort
system
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
terminate
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback
exit
_resetstkoflw
_wassert
api-ms-win-crt-convert-l1-1-0
strtoull
strtol
atol
strtod
strtoll
api-ms-win-crt-time-l1-1-0
_localtime64_s
_difftime64
_mktime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
cosf
fmodf
sinf
sqrt
sqrtf
ceilf
powf
pow
acosf
_dclass
Sections
.text Size: 908KB - Virtual size: 908KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 297KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 421KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ