@8�����||�T�����}���$"�t����/_�|HKf�O���]�4Zł�е�A$"hV�%�/��co-�oaU�ZF�t9�G�?� nW��� �(��;��@���p2�_�X[����o��L>,}�*� {��3R�FW�-pPf�:f�J���F���/�^6��G�RM2͎ �Pwp�AȌ�kb�?��(�A���$B�f�-�I_���a_���r��e�Uu3�����������n�u+�袙��%�M�KG����{�' ��#�m�R�x�!�'Z�u�4���,���>�A�����h|k�&���R��x��ky� A���L�ќ�����(�}��k�)�X��y�-�{-��9ݸ�R^� vE����u�V'Hg�|f����F���9�?PudV�I�U������#1���;��9֟��o:5 ��6?�˲���C+�_��ʼ|<mJ*_/A��E�z`'�f#�F%����1�?'kVָ�ӮO�_$�҂����C� ��vf�1���B�Τ��U��7�5��������=z��Wt@��4��a�5�@�h�},T�d�1%0��Y`K�QȪ��� L{�>R_��j/�'v�����U��!ӟ��Gy�OO% ֶ\��<]R#na�A&Ie������w���c-iel���̷�9X��sL�(Ý����E4��&ǜ:�Q�u�@�a�@���3m�+iO"�@���3�]�VaL� PTX�5f� Z���k�P���[��T�g9ݛ����*K(4�X,>������:�˩�r|H8�fZ�шݕC�h&�q -�*F�!�Y��\E��C�6��2���SS��_�ɨT>QH�@`�Ja���r�����U_A���?뀺�_^x<���&������G�+|�7}���t]��G /��+NDz�������m{wwf��`8 ar-q�Dn�����J�B!ox����J�Y��)p��s���CB�-��g��(�����<Aͻ<���/���3ˏ ��GZ�:`n� {\�b� O�y@��D��12�JYzM�9�7�o����G�ٍ���9�슺� YCl+[�Hd٬�:A�KL+���\�m���r�q;IM�M9�;�� J�K���mXK#N�p��r�r��_����Z����]�s�]|W�J�yw;U�.��h��kp�N����3QBGz��=Jz�"0X��ip6>I��aQ<�;��RW� �1����E[Mp������[Ge��������'����͟V�}���i�JB�!�LE��tm���Ye�����K�$�R��{n5HV�fw��湺��%ܐ�X:�4��>��_ H'!W�$�� G���?'P��N,~��;�V/)��B��m�б�����3���7����!+�^TP��` ����iyQ.a#zG�h�ܐA%��q��|y�.2�1?f� �k�J8|���[��/�2'g����2������g�`�yS\��*:�pҗrf�#���� Ͻ�K �mib�n��Lӯ����os��JM�`XY�Hj��Pn#m�v���ٛ���3/5���?��Ԗ� rJ\��,j��.�W��G������Q�h���[8=������l�\�ذ��q -]��D�XlG)P�0�mU}{@?��D����D�[-�٥Tҧ������a������;t�)�#�̈�z��Ѫ;U9�*���H��?`@W������uY�C3�rG!P� ��g�{� �YS�'�<��F$��ə�!�fK���(�l� e���).����5 �� V�jJ���^$��Y��]������Nۈw�����T"r�� ]��CW�i� ��5q-�[,e���A��u'qySL�9���/��������MU���_|�#�x��Ū .ۜ�� �k����@A��S��^S��]K��M�����S����3�"�'KbU��$�D^����� l��ozEBY6I�h�d��0[��S�[�4����.ybx���j����ꁃ�@��8��(�i��W�ao>t��n!�9���#��\�p ���-��>�����y�h��(_����7���T� S�����?��lw���7T�;#c�W#�k�T��^ ���i����p�! b�u�+��y����]!�h�s�< ;+Y��A(\�G ����N�Dbo�7Ձ��e����3��M,�K��n�5$@�6U����nF�����bh'li�Gk��>���T}�k�Yf�p-�'��a����C�u��^��Kͱ�{zآ�E�"��+�h��ܻ1�{!�"#xYIl�'��Դ���~�z�Ma�h��s��9� LaQ�_]����p�����r�X���w>��md������P�0�z�4�Z���ñ�И����v�=����J���S+�lʑ̄SD@R��l�� 3V��Y���j5i~�3F�fs!�V�V�8�t�J�M�;��+@��QR�a��K>�?�&��l�����`�Y�[� ���1���m}����W���Z�C�WN���0yI#�@����Z����$�70��Ec�x��k��l!c"{�I$��x:~#|�#L� �;�k�^�JM�5����4`�J�n\������[7Ӓ�k���$SJ����w��� �u5uĀ��/O���,-D:8a�$��]�4U�ۘ[��0ر��A��ۖRz�n�KS���Pb@��c���IJ��~�����#�f�"����*��.쇑v�v���16� ɗ�3� =���0��t�X��>&�ہ���� 吥�̲�X�o ��.�'��}hK�)01@n�o��D���>���5�HE�ߗ��C�>��:\S.#�C����챓� 5ȫ���������/��ys��ct����z�i�PܨX���c|JN7z��,Y+�Yo�t������*�bB=X���3�;�� ��;_��wk}V�C}}J�I��&�\��z�0��7O�\�J1�W�*M����,��G��o+��S�z�y4p��c6� ���M+9}�gm�����l���\���h�~g��܊˅������B��-�'���u���0��qr�w��T�}a�i__�$.a���D� 3gi���� 9�ȻQ��mG�Kͦ�(]������@�Q�m�9f�����+��e.3�a[)A:M"�֠ݺ���}�j��<� <���j����S�=�Z�������&:������N����a���4E)c�cm��pQ�I���l� 1��ID$[���́QE.��BVZ|8��Z-;B\�B���W�]J6|f�y!��SOa96������}<�jO����HR�������4�fվ������]�9������ʄ5��M( u��a8�ʞ͂wb _|�b��;� t�]��_�d�T�x[�M�Н r^��k���*���#[��;6YkfiO4]\*E�FJT_�o�jN9Y�����V����]x��W|^�u�\���/+��d'Ɇ0 !��*1�;cYC�W�2�ww�ݽ�u���F�%������e���5\h��mi0M
Static task
static1
General
-
Target
HWID_Spoofer.EXE
-
Size
3.6MB
-
MD5
5dfca23ef938156f6786925b6484e8e2
-
SHA1
cbb9b794bdeb26c5e823de22993cce4a79c2ec25
-
SHA256
8258a737c4d043f4a68f9b47912c2210a28df732ed098561ac97b421af44cf27
-
SHA512
df47022df3e0c282fabd4d60ef5cefe7a7a413c0a5e30d26c2360d0108ecc2c8c663d636eb53205e93f5f5d7d1997efc9ceaeb4c9c27e4a318ecd64ae3b298fa
-
SSDEEP
98304:NBYX1fC6+yen02NVeQn7AijqJpbsdRMbk:NB6Z+yenBneQEpbn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HWID_Spoofer.EXE
Files
-
HWID_Spoofer.EXE.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 263KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 77KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 27KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 165KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE