ExP-Spoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ExP-Spoofer.exe
Size

901KB
MD5

897d7a3dfb2a684d5cf9741dba1379e7
SHA1

806daf9349798212877b90ed9cf5adc571871fd0
SHA256

6c56d89051c80fe92eb08fc01811bf7557ff487a1d88046f57705111b99365be
SHA512

3928eecf10878f86d7000de2ea5e9b6dbffc864c2eb4557ed31470192fbc2f6566b2f4d32c0f04412cf8ed347fd18e87048015d749db4182310fe9e6509f281e
SSDEEP

24576:RJc9mbUvTkojiYXxi9g0aCqt17y9a71aie1RpRUyLcDICkS:3aa3qt129a71aiex9o8CkS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExP-Spoofer.exe

Files

ExP-Spoofer.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\cold.cc\Desktop\new\x64\Release\ExP-Spoofer.pdb

Sections

_0
Size: 871KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_2
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_3
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_4
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ