Behavioral task
behavioral1
Sample
Val Spoofer.7z
Resource
win10v2004-20240802-en
General
-
Target
Val Spoofer.7z
-
Size
4.8MB
-
MD5
e94d3f5025c31db6bf312ccc117983ae
-
SHA1
2ce670624bc367ea4f3cc5296f780811693a71b6
-
SHA256
e87ea1ec7811d357cdbd5fcca222eee25ca13e6cfd95924bf30056d69742e339
-
SHA512
4428ba50ff2f380b0322077b3a3347bd1da789c45b934f2cc149d5868625a8c931e62aabf01310c2e541dfb54ed26e1bb7fc032319b73d2fa9e107e944493a15
-
SSDEEP
98304:xwVfpH5y8dQ57qvGzVDe3d6iFpxBrIDmlfHwGLlnZuJqv6u+xy10Di0J6tS:xufpTdQ57SY6304pxBYm9wSv6u+m094S
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Loader/Loader/Perm Spoofer.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader/Loader/Perm Spoofer.exe
Files
-
Val Spoofer.7z.7z
-
Loader/Loader/NETWORK/ARP.bat.bat .vbs
-
Loader/Loader/NETWORK/MAC.bat
-
Loader/Loader/Perm Spoofer.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 381KB - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 75KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 872KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 5KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loader/Loader/Serials Checker/READ ME.txt
-
Loader/Loader/Serials Checker/Serials Checker.bat
-
Loader/Loader/imgui.ini
-
Loader/Loader/valorant spoofer.1337