PermSpoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

PermSpoofer.exe
Size

374KB
MD5

341a939029880fc9414603735a927e1c
SHA1

f310922b184f5c3516fe864841e0e692c5703528
SHA256

423d9efe71aca59a32cbfae003e64d08a0b822757063a0c6fd6654465ea10abe
SHA512

bf0e834a23334f9e4fb612c6df77a72aaa61da969ccfae786ded951527ba7a9b5cb37a5d31ffe05dfae64828ec2a70a9daf6d35ead5a887cd4468a24812c518c
SSDEEP

6144:VH8wvq1QC/4Bf0UMhLL0Lcf2al8Js2e0d6pHTI9wj+0LQzc:ST5kf0TLLEc+aWmQ6lCBO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PermSpoofer.exe

Files

PermSpoofer.exe
.exe windows:6 windows x64 arch:x64

13669765fe32da2ff216bf362659e1f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
WideCharToMultiByte
MultiByteToWideChar
MoveFileExA
SleepEx
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoA
FreeLibrary
GetSystemDirectoryA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetModuleHandleW
GetModuleHandleA
SetConsoleTitleA
DeleteCriticalSection
OutputDebugStringW
InitializeCriticalSectionEx
GetLastError
ExitProcess
GetProcAddress
CloseHandle
LoadLibraryA
Sleep
GetCurrentProcess
VerSetConditionMask

user32

MessageBoxA

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt
CryptImportKey
RegOpenKeyExW
RegSetValueExW
RegCloseKey
CryptDestroyKey

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

normaliz

IdnToAscii

wldap32

ord143
ord217
ord200
ord46
ord30
ord211
ord60
ord45
ord50
ord79
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord301

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CertCloseStore
CertOpenStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain

ws2_32

WSAStartup
WSACleanup
accept
htonl
WSASetLastError
ioctlsocket
__WSAFDIsSet
socket
setsockopt
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
ntohs
htons
gethostname
ntohl
getsockopt
getsockname
connect
bind
WSAGetLastError
send
recv
closesocket
WSAIoctl
listen
getpeername

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
strstr
__std_exception_copy
_CxxThrowException
memchr
memcmp
__current_exception
memcpy
memmove
memset
__C_specific_handler
strchr
strrchr
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
exit
_errno
strerror
__sys_nerr
_beginthreadex
_getpid
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
realloc
free
_set_new_mode
calloc

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoll
strtoul

api-ms-win-crt-stdio-l1-1-0

__p__commode
_write
_close
_open
_read
_set_fmode
__stdio_common_vsscanf
fopen
fclose
__acrt_iob_func
fflush
__stdio_common_vsprintf
fwrite
fread
feof
fseek
ftell
fputc
_lseeki64
fgets
fputs

api-ms-win-crt-filesystem-l1-1-0

_unlink
_access
_fstat64
_stat64

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

tolower
strncmp
strspn
isupper
strncpy
strcspn
strpbrk
strcmp
_strdup

api-ms-win-crt-utility-l1-1-0

qsort

Sections

.text
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13669765fe32da2ff216bf362659e1f4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

normaliz

wldap32

crypt32

ws2_32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

.text Size: 283KB - Virtual size: 283KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 283KB - Virtual size: 283KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB