General

  • Target

    spoofer (1).zip

  • Size

    10.1MB

  • MD5

    31b6760062e6ed5456079ebcd1023b05

  • SHA1

    0d8fe4bab74a941c55c09d88a2be22125e09b6d7

  • SHA256

    5d1d95895ca3aaddebb3c4956605043d6932153ea74243e4b89a9339deb371c4

  • SHA512

    3d06fb880fc4f35ed1701179b3affc390a1da3c11cb371944ceaaf1756ce66638d5a9aaf92b83063d33f858c699a06ea2967bbe2d474bc6f92663f2c2ca21256

  • SSDEEP

    98304:0Nb7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6KG:0U+y4ihkl/Wo/afHPL

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • spoofer (1).zip
    .zip
  • spoofer/spoofer/cleaner/1.bat
    .bat .vbs
  • spoofer/spoofer/cleaner/2.bat
  • spoofer/spoofer/cleaner/3.bat
  • spoofer/spoofer/cleaner/4.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • spoofer/spoofer/instructions.txt
  • spoofer/spoofer/spoofer/MAPPER.exe
    .exe windows:6 windows x64 arch:x64

    384d774ba09e4953698d5e7a14598118


    Headers

    Imports

    Sections

  • spoofer/spoofer/spoofer/randomize.sys
    .sys windows:10 windows x64 arch:x64

    9cd3a2254af2c5c16a99addca383bf7f


    Code Sign

    Headers

    Imports

    Sections

  • spoofer/spoofer/spoofer/rdmnull.sys
    .sys windows:10 windows x64 arch:x64

    f94d546ff9f6c68715317e36e751e07c


    Code Sign

    Headers

    Imports

    Sections

  • spoofer/spoofer/spoofer/virualize.sys
    .sys windows:10 windows x64 arch:x64

    df552bc149e9cfef3db42fe67d0113d2


    Headers

    Imports

    Sections