ANUBIS-Best-HWID-spoofer-main.zip
- SHA256 3c1f47ab0374dbb60884306c5556050e9d10ba75c6bca63d09ae49b2940878ac
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ANUBIS-Best-HWID-spoofer-main/Anubis.exe
Resource
win11-20240802-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ANUBIS-Best-HWID-spoofer-main/spooferconfig.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target ANUBIS-Best-HWID-spoofer-main.zip
- Size 4.0MB
- Sample241006-csmpfavamb
- SHA256 3c1f47ab0374dbb60884306c5556050e9d10ba75c6bca63d09ae49b2940878ac
- MD5 7c9b5ee905e3fb741e7b9e988d4572c1
- SHA1 c9b7f1fbffa3375c81cdacc238ebbc527f68d1f1
- SHA512 bdc987f1d602dc9defcec11b4b43713c6b4c4c90a57834448a376a06ab8735d9642438220a23cd37daaaf72952288c99317bf93c05f23365a8b2ff4f4083953a
- SSDEEP 98304:HlGsTi4l2bNvOewSd+GapwfEJvaMU+GDElZz+ACq2JKsH8vp:HQsueM2OoVR0r25C3+
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ANUBIS-Best-HWID-spoofer-main/Anubis.exe unpack001/ANUBIS-Best-HWID-spoofer-main/spooferconfig.dll
File Explorer
-
ANUBIS-Best-HWID-spoofer-main.zip.zip 4.0MB
-
ANUBIS-Best-HWID-spoofer-main/Anubis.exe.exe 1.2MB
-
ANUBIS-Best-HWID-spoofer-main/LICENSE13KB
-
ANUBIS-Best-HWID-spoofer-main/README.md463B
-
ANUBIS-Best-HWID-spoofer-main/spooferconfig.dll.dll 6.0MB
ANUBIS-Best-HWID-spoofer-main/Anubis.exe
- IMPHASH a9c887a4f18a3fede2cc29ceea138ed3
- SHA256 4b350ae0b85aa7f7818e37e3f02397cd3667af8d62eb3132fb3297bd96a0abe2
- MD5 c2adb7ff42f1c961035f17bad5bee12d
- SHA1 e2ae36539f9ff88e8a89d750e99d15ea6e84f0dc
- SHA512 16413f90689cfa3fc509637bea54634ead1bba7f89d621bbc8096279f2413cd3477142a63becfa457e5756583c34049699ab1e960d1133dad2f72e3325ecb348
- SSDEEP 24576:uDDgbYd14JwD00GR/L4Sgh5ovGpuIGPBgyjhgQJ8L/inWS:gcbILXoO3p9GP6ydk/inWS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5329
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit
shell32
ShellExecuteA
kernel32
SetUnhandledExceptionFilter
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ANUBIS-Best-HWID-spoofer-main/LICENSE
- SHA256 8c349f80764d0648e645f41ef23772a70c995a0924b5235f735f4a3d09df127c
- MD5 2dd765ca47a05140be15ebafddbeadfe
- SHA1 cc1b9f6357720c4005d01f48196e732e6f2415ad
- SHA512 80bf2bbc35f1bbbbe6f6aed1c441758a129dfcc721e4ee17c6212719c0ea1a0faa2c2da643cef304287668f772bb017f1de9ecf058b1e95b2a2040d4533f32c3
- SSDEEP 384:/0u1CIkVEj6TU2Fa/5NuYuP7kND+2mKKm:dkBFcGA0RKKm
- MD5 SHA1 SHA512 SSDEEP
ANUBIS-Best-HWID-spoofer-main/README.md
- SHA256 7f0c548185f1cf778e238cce96683f5b19e6cc1f3c8c1267408a0b8b18ab49d1
- MD5 59f2280d283a45a36e3974c02458c4d6
- SHA1 bb9f8d5356999ffcf6e6d7847db454111e87550f
- SHA512 77a7bd1da565cfe255b5030d037b4225341fec3e8def190c40473410257c30149e88716d347a53c1381312f4c6dfc7e2a18ec546a2f41055bbe06b29a0e527ab
- MD5 SHA1 SHA512
ANUBIS-Best-HWID-spoofer-main/spooferconfig.dll
- IMPHASH 7e8ab85d38ca9ddc32f9ba426542109f
- SHA256 35f12093577d9c58fe7858ca26a935aaf409269057a9a8bdf975693d6dfe208a
- MD5 f553ad722875c02d5b45f5c975ceb771
- SHA1 867f41aa5b67cf7e15e3efe6cb4360f8f415fa6e
- SHA512 041924f9a64d626d1a3b7111de968f11cc08d384b9dcd47e832744bc195d71d6f58bf06cc9f14fcf31a2f1490230779d9a1afd70e8eb836424fd14d59e6f663b
- SSDEEP 49152:Z9EWdahQOLgGyX6lRu6vz3ZLZh/qNwffAj3g/bTqSk6Fi0Lp5eo0Jvn:DaNFz3Z3/lgQ/6Sj5wv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
974452
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\EtoShinya\source\repos\M\x64\Release\minty.pdb
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetModuleHandleA
LockResource
LoadResource
GetModuleFileNameA
VirtualProtect
GetCurrentProcess
Sleep
CreateFileA
GetProcAddress
lstrcmpiW
GetCurrentThreadId
OpenThread
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
LoadLibraryExA
FormatMessageA
CreateThread
AllocConsole
QueueUserAPC
GetModuleHandleW
FreeResource
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
SizeofResource
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
GetLocaleInfoEx
GetCurrentThread
GetTickCount64
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
AreFileApisANSI
PeekNamedPipe
WriteFile
FindResourceA
ReadFile
SuspendThread
VirtualQuery
user32
CloseClipboard
EmptyClipboard
ReleaseCapture
OpenClipboard
GetCursorPos
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
EnumWindows
GetClassNameA
ScreenToClient
GetWindowThreadProcessId
RegisterClassExA
SetWindowLongPtrA
CreateWindowExA
DefWindowProcA
CallWindowProcA
FindWindowA
LoadCursorA
SetClipboardData
GetKeyState
GetClipboardData
GetMessageExtraInfo
SetCursorPos
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uncaught_exceptions@std@@YAHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Random_device@std@@YAIXZ
_Cnd_broadcast
_Mtx_unlock
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
_Cnd_timedwait
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Mtx_current_owns
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
msvcp140_codecvt_ids
?id@?$codecvt@_SDU_Mbstatet@@@std@@2V0locale@2@A
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySection
NtProtectVirtualMemory
RtlVirtualUnwind
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__std_terminate
__intrinsic_setjmp
memmove
memcmp
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memset
memcpy
strrchr
longjmp
strstr
strchr
memchr
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll
abort
_wassert
exit
_errno
system
_beginthreadex
_configure_narrow_argv
terminate
strerror
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf_s
fseek
feof
fread
fputc
tmpnam
__stdio_common_vswprintf
fflush
fgetc
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
__acrt_iob_func
fgetpos
setvbuf
_ftelli64
_popen
tmpfile
ungetc
_pclose
clearerr
fgets
fsetpos
_fseeki64
fclose
getc
fopen
ferror
freopen
_get_stream_buffer_pointers
_wfopen
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
_mktime64
clock
_difftime64
_time64
_localtime64
api-ms-win-crt-string-l1-1-0
isblank
isalnum
toupper
strcmp
isspace
strspn
isdigit
isxdigit
_strdup
strpbrk
strcoll
islower
ispunct
iscntrl
isalpha
strncmp
strncpy
isgraph
isupper
tolower
api-ms-win-crt-convert-l1-1-0
atof
strtod
strtoull
strtoul
strtoll
api-ms-win-crt-math-l1-1-0
sinf
sin
pow
logf
tan
log10
log
fmodf
fmod
_dsign
ldexp
_dclass
acos
acosf
asin
atan2
frexp
atan2f
ceil
ceilf
sqrtf
cos
sqrt
cosf
exp
floor
floorf
powf
api-ms-win-crt-filesystem-l1-1-0
remove
_lock_file
rename
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
setlocale
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-environment-l1-1-0
getenv
Name
.text
Size
963KB
Virtual Size
963KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=32420,
count=1, id=253, version=32420,
count=29, id=261, version=32420,
count=8, id=260, version=32420,
count=4, id=259, version=32420,
count=3, id=261, version=30709,
count=21, id=257, version=27412,
count=441, id=1, productName=Unmarked objects,
count=80, id=265, version=32537,
count=1, id=255, version=32537,
count=1, id=151,
count=1, id=258, version=32537,