H�N����4~��x���(�(]�ɗ��o}<��~��X���i�5������B�ık�I-�'2��8ZA�x&�ij�gl�[0����t[@����y '�urRF �V��-u%�h�u5 蟗�i�}\:��99�w�6υp�u��0�'���F(��A��X��,�ƶ�:�� wPҰ�0��d�E�/6g�Am�d��?G���"� a�'�f����4�=s#��Y�~$��i�l�T*���6-o+)�j��q9zCʵ�|5K!c�cUsA���L���* ������M�z��mDQ�/����G��>��簺����v���{��ZI��+��/[���ޯ�>���he�y�%\��`g�Q���L�L6O� �5�f�;�5��I@�j)nݰ�a8D� ���B2%Br�\A��IH��i���8�� ���zR�x�5��$�;�{����m�L �&�r䄞��p-|�m�q||:Ky!T���F��?B���H����Z��2�/�V�K�^�}�@xb�8?��H��/��.?B�w�)�s���i��#�#�l^�Aw�Y�z�0(�uͿw��W�L��̀�N�غ�ݕ�������!B'!��/�N"���Ul��9Y��j;��Z%�`�}e����L�6���`eP��ц������v�����Rm��`S^���q�E�C����;����a}��G�m��E���L������A���.�:�䬢�`�dD����B��J����GĔٍ����\����\N������͆'����W+�l�Y��>�d������-tLdK�jz���x��,��GO��A�3�8d�� �.���}nj8颼��މ�a��H"�sVW��|r�xҖ�ZH�0�o���**qB1�C`V����Z�V�mW5 �����*� �|�O_� 0�ׄg�B��5���2�E��]�4`S�ƈ���^��P���]4�A��) Id�'��K�/D7�� ;U�;�6Y,H�vQr�ʁ>i5+����Z�An�o�����`-��_�N�%�GA����2N䑵9�oM �l�`�5A�&���i5��s#�pn_����vE���^��lѤ秶d�6�ޔ(�o*��5�&&�ҿ�3�[x��A���;�(�b��9����Z�s�}�ջL�0������Rq��lwo���K����Fဵ�.% N���#��l��8k���j#�=˃{�{�F���C�~+��E���Z�� %(���a��2�3�DGֶU� ��au������.�hw�14Fh�H�V��0�uI�u:�zj\��:�������P���ު &C6� ���#{�w[�������i�$D<P�fl˫+������#nֻ�����jbj8��I�o�0������<~1�~�V�m�S��*�����h٩c���\ �N����Oa�s�rp *T�3 @�1j� ���U3�GY�bo�G=9� i%��:�V��~I�'.�QLJ| f�Z�e�V�N5�M'L�U�%����n��iǼr�{�4��[dܽ�U[z>q�\��dBl�]�����\�����S�]G��E���Ge�wŜ�>�U��㝽Ds&X6pae��|6+/7��dhOG,~!˛4'/+������<�^�F�@��QY$Z�(m���[H_X����l����T\gl�W ��,�#q�kDy�W�<Dh�����S^�OM��x��jr�H�����{�E��v����u���+� b�f�����{�~\���cHL��h��G4������C���!A�cv��$� �W��D䣓�L�|4!�D!á��C�D��:���� ��|8���㫁H^����8 U>z�`��cN�y����qU�������?��$����� 3x%�H�iȫI���!m,�%��������nq�L����lz�4m��d뀏��9�2�{�%|T��%��!'�A}<�c���;D]��F ��D����|�F�nM>�9��M��sUE�� ���/tǝjL��hX����Z�������4�z͑"BJGߴ��f�R��R���V/��@�*��m�Bx)�(,�'�g+�"Z�h�k�Y1���a��-O�e�)˭���J�'?��C��I��GkWC}=��n�gv�P�E]>{G�kC����Z@|�(c���=�$'<��o�4B�H·Ύ��h�4�O=�gŨ��7a'��fҝֳfWL����>ç�=����Z�<���Qo�bz �c�d�!Jr��L�RS3���_z ��l�$�'��|p�$���Ȍz,��S��} � ��p��A/�5�Ir��� ,_�:eW^�-�G�7[l;"̪��aɥ��Ч6އ���d��_(/٢��%����*2�M�z�aC�mt.�����֥Z�817i��o(�9�Ra�d�c̈́*ܪ'�6��f�#ŲG��xP`���O���r��{T�w\o�Zm\Z����9!H!\�U�Q���jƴ�O�6���<bሳ��p��<�u�-%����|B",C�;�Z�q���=6���$Y��h����0-�u7EY)!�xg�j��:�9�.$O�6E�$s��.�U+(�&��4.�g��!� �A_����{b���EJ�E���S�� .I{��#4 ��N��Zڪ3�4K�I��j_�J9"���e�4���&c��`W��!3���_�+��#���}�9�b?d��r�v�łBv=*���`�vUd��@Lfw܅g��P� ְ8�Q�{L��.�dQ(�ֵ�K9��]��B�'�(�15U7�K�{J�Q��f(����1���n��ox��8~�\�����Ũ�eOC���F��� �J�ըz$X��D�Yf�j�.]��`�T�:�-�2?����P��W��!��M��2�����kJ7S^��4�F?\�R3F9:Ah�#T���F�]vx�9hY�����n 1x<d���s��`�L܊�S�ߺ�����k�d��:';7Z��` �8�_��.z����2�#T���jmM-�(� U�W/�'� ځ��u��f��A�����0�&�I+pÉ�$(Ĵ�r!��c�~�H�F.���/��mk:��vnA֑ǔ��Cw��ב4��/\bC�q���Y��G�b�66��y��t3� 0g�I�;Vn�7��i���Oy�� 8�00�Q��"�v,�� ���XĊ�S[yM������S�v�ܟ����0"BaN��$5��D��fr���a�H1R�f'( �F�p�HlOùm������ ����vl������^p��!�Q�g������0���E4��rqIٯ�x<x�����������P�5�U���މ68�� ���/Yf�,zp���0G����j`p+r������� ��K�}�<x��d��,Ҡl��d�^��~]�*��>�,����q���m��'ΑJ����"}���t�>���RZ57��K���nĀ�JGTi��s����gb�����.����W�\�X�$)���H�w�U�%��T��BޑMdh��(_d��i��Ҏ��e)7?�dp�����q�Z��NGk�$Vu���@��S���[�z�L���1j���%�˽۹��42��I���Z`���㝏v�������<12 �x��0�:Z��J�<���T�p���(o&t4���]&Ʒ���*
Static task
static1
Behavioral task
behavioral1
Sample
HwidSpoofer.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
HwidSpoofer.exe
Resource
win11-20240802-en
General
-
Target
HwidSpoofer-1.7.0.5.zip
-
Size
10.5MB
-
MD5
c75bbe6e17cab1a64dcbea76a7521824
-
SHA1
d19590e36cda9a7fc40c24bdd6f2de6919d7578c
-
SHA256
9c6e1c3f7564a435e0c0bb09dabd271d74f8b4b552d95af7c78b86202b6eb8e7
-
SHA512
be90dc67d6f7de264493be7b7bbe13c642f110e687507523fd285695748e460c454fb728ea8570d36e622966b3c419752c3e9b88d2b5f43cb991c0186c36d49e
-
SSDEEP
196608:ofTbZVTThrC5VZShbp4qgrpixtz0igfm8kpzrod53GzMeaPeS02d7u4FH:ofPhrRUrAmezRror3GzMpPeIu4FH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HwidSpoofer.exe
Files
-
HwidSpoofer-1.7.0.5.zip.zip
-
HwidSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 301KB - Virtual size: 11.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE