D:\a\Soggfy\Soggfy\build\Release\Injector.pdb
Overview
overview
10Static
static
10Install.cmd
windows7-x64
3Install.cmd
windows10-2004-x64
8Install.ps1
windows7-x64
3Install.ps1
windows10-2004-x64
8Release/Injector.exe
windows7-x64
1Release/Injector.exe
windows10-2004-x64
1Release/SoggfyUIC.js
windows7-x64
3Release/SoggfyUIC.js
windows10-2004-x64
3Release/Sp...er.dll
windows7-x64
3Release/Sp...er.dll
windows10-2004-x64
3Uninstall.cmd
windows7-x64
1Uninstall.cmd
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Install.cmd
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Install.cmd
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Install.ps1
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Install.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Release/Injector.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Release/Injector.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Release/SoggfyUIC.js
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Release/SoggfyUIC.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Release/SpotifyOggDumper.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Release/SpotifyOggDumper.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Uninstall.cmd
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
Uninstall.cmd
Resource
win10v2004-20240611-en
General
-
Target
Soggfy-2.7.3.zip
-
Size
443KB
-
MD5
608bea798f0138b782887964dba670d1
-
SHA1
1fd7e62c718a894affb3a29ce4f1b8d486772bc4
-
SHA256
b5817f1f083c34340a84792c26f173416429ed3640626a32c3a031c9898e036b
-
SHA512
915590f344acef0b05b259021c86ae4c797e28d89d85bcfc39e6d23ee7cf70bfe5b706041b035f5b9461135ae8ca113d1186a1fa3228a14297eec7013f21679b
-
SSDEEP
12288:K2Aceq2YNRZ9ADLeOG7IvSaIM3wNlvU5e/7Zt:EdqJ8DLRG70/pwfwiX
Malware Config
Extracted
https://upgrade.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.31.1205.g4d59ad7c-1561.exe
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/Injector.exe unpack001/Release/SpotifyOggDumper.dll
Files
-
Soggfy-2.7.3.zip.zip
-
Install.cmd
-
Install.ps1.ps1
-
Release/Injector.exe.exe windows:6 windows x86 arch:x86
797ae20d912e2d5c2ff9c8059818b0fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteProcessMemory
GetStdHandle
SetConsoleMode
TerminateProcess
GetProcessId
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
GetConsoleMode
Process32NextW
Process32FirstW
CloseHandle
GetProcAddress
VirtualAllocEx
CreateProcessW
GetModuleHandleW
CreateRemoteThread
VirtualFreeEx
GetLocaleInfoEx
FormatMessageA
LocalFree
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
user32
GetWindowThreadProcessId
GetWindow
EnumWindows
IsWindowVisible
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?good@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
vcruntime140
__current_exception_context
memcpy
__std_terminate
__std_exception_copy
_CxxThrowException
__std_exception_destroy
__CxxFrameHandler3
__current_exception
memmove
_except_handler4_common
memset
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
__p___argc
terminate
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
__p___argv
_controlfp_s
_c_exit
_set_app_type
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Release/SoggfyUIC.js.js
-
Release/SoggfyUIC.js.map
-
Release/SpotifyOggDumper.dll.dll windows:6 windows x86 arch:x86
8d05392a9df431a8bcb1638202add86d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
D:\a\Soggfy\Soggfy\build\Release\SpotifyOggDumper.pdb
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
CloseHandle
LocalFree
DeleteCriticalSection
CreateProcessW
GetExitCodeProcess
GetStdHandle
SetConsoleMode
GetConsoleMode
FreeConsole
SetConsoleOutputCP
AllocConsole
SearchPathW
GetCurrentThread
ReleaseSemaphore
SetEvent
DuplicateHandle
WaitForSingleObject
InitializeCriticalSection
QueryPerformanceFrequency
QueueUserWorkItem
CreateEventA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetErrorMode
LoadLibraryExA
FreeLibrary
GetSystemInfo
SwitchToThread
RegisterWaitForSingleObject
UnregisterWait
SetConsoleCtrlHandler
DebugBreak
CreateFileA
FlushFileBuffers
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
CancelSynchronousIo
GetNamedPipeHandleStateA
ResetEvent
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetLastError
LeaveCriticalSection
CreatePipe
RaiseException
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
MoveFileExW
CopyFileW
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
VirtualQuery
VirtualFree
VirtualAlloc
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleW
VirtualProtect
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
Sleep
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
ReadConsoleW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
WriteConsoleInputW
UnregisterWaitEx
GetLongPathNameW
ReadDirectoryChangesW
CancelIo
SetHandleInformation
ReadFile
GetModuleHandleA
CreateThread
FreeLibraryAndExitThread
InitializeCriticalSectionEx
GetModuleFileNameW
CreateSemaphoreA
CancelIoEx
EnterCriticalSection
user32
GetMessageA
MessageBoxA
GetSystemMetrics
TranslateMessage
MapVirtualKeyW
DispatchMessageA
shell32
SHGetKnownFolderPath
SHOpenFolderAndSelectItems
CommandLineToArgvW
SHCreateItemFromParsingName
SHParseDisplayName
ole32
CoCreateInstance
CoTaskMemFree
ws2_32
getpeername
freeaddrinfo
listen
WSASetLastError
WSAStartup
WSARecvFrom
WSARecv
WSASocketW
WSAIoctl
select
ioctlsocket
getsockopt
htons
ntohs
recv
send
setsockopt
shutdown
accept
bind
socket
WSAGetLastError
closesocket
getaddrinfo
msvcp140
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?uncaught_exceptions@std@@YAHXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_wait
_Mtx_unlock
_Cnd_broadcast
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
_Thrd_detach
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
_Cnd_destroy_in_situ
_Strcoll
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Strxfrm
_Cnd_init_in_situ
?always_noconv@codecvt_base@std@@QBE_NXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?good@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Xbad_function_call@std@@YAXXZ
vcruntime140
memcpy
memchr
memmove
memset
strchr
__std_terminate
__current_exception
__current_exception_context
_CxxThrowException
_except_handler4_common
__std_type_info_compare
__std_type_info_destroy_list
__std_exception_copy
__CxxFrameHandler3
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
free
_callnewh
calloc
realloc
malloc
api-ms-win-crt-string-l1-1-0
wcsncpy
toupper
tolower
isalnum
isdigit
strncmp
_wcsnicmp
api-ms-win-crt-math-l1-1-0
_ldclass
_fdclass
_dclass
_dsign
_fdsign
ceil
_ldsign
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
terminate
_invalid_parameter_noinfo_noreturn
abort
_errno
_seh_filter_dll
_crt_atexit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_cexit
_initterm
_initterm_e
_configure_narrow_argv
_set_invalid_parameter_handler
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
atoi
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
fputc
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vswprintf
fflush
_close
fclose
fgetc
fwrite
fgetpos
__stdio_common_vfprintf
_get_stream_buffer_pointers
freopen_s
_fseeki64
fread
fsetpos
ungetc
setvbuf
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
Sections
.text Size: 446KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Uninstall.cmd