Static task
static1
Behavioral task
behavioral1
Sample
fuck.bat
Resource
win10-20240611-en
General
-
Target
Desktop.zip
-
Size
11.3MB
-
MD5
31aa6e925e791aa707174d829446ddce
-
SHA1
668d3c2e66476599f7cf74ea7a8854b3f8b1ac3a
-
SHA256
b6d642b198b90c6001ac20cb7a3d5dd310da2694a8ab325a039d266ec2317edb
-
SHA512
d36c23d838646dcc8d5818e3e338de5089b4e090a7b0c462944080139349025a6fc3f3517a30986074701b7bde8da1c53093dff3626fe114fc8f14d5d75188be
-
SSDEEP
196608:WQpUy6jMsDXjeuCmlDNj42r5SWAbXVSBUsGugidr1OxsX9+MoCOzRP3RhyZ:dCy6oeXj+mnM29SWAblJugAPt+MGRhyZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xx-spoofer.exe
Files
-
Desktop.zip.zip
-
fuck.bat
-
server.crt
-
xx-spoofer.exe.exe windows:6 windows x64 arch:x64
564ed17ed95bf3fc8295fbbccb805a64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconA
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
dxgi
CreateDXGIFactory1
dwmapi
DwmSetWindowAttribute
urlmon
UrlMkSetSessionOption
wininet
InternetOpenA
userenv
UnloadUserProfile
ntdll
NtQuerySystemInformation
Sections
.text Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 12.0MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ