�8�F�|�稏Li�'�Q�z���Fr���EWp�q�m5ݪz��d�������s&�;�6x~`U�����;�����Ģ���q ��f(Cz��(���s�`�F���*�ٓ�����稒�X=��x�:I�uaOT�+�rH���!�7�l}r�����Z}}����NP�Y��[����(*�#�a�M��Г�|�����F�Av �"Gz-��=*�p�`|3k0� ��[|�#|[+*X� 5�-�BR_���u!k���>�֙��$������,�z�2�)�����N|� �����d�(!�xO+M)�"�I��И/��:�h`��+�r�ٌ2ҦD���jq���A��3�D$��a+���l�J�S��@����[�R��|��a�A��5��p����.����ظ��������u�R���kx��c�}db$YZ�{\�n���%kǥn�6�$�QEK�$×.GL��s� �M�m��_�_������O�o�P�,������=����8~� �/�}��]5[�����.�����u42OO^ Z3�-���,��'A���,�C�8�&ܟݝ5��e��LB(�ڍ�q ]���y�9;�� ��4t�-�X��]�@ ��������s���ܜ�AN��m��=<��-sA�=I[�pX~A8*ԉ���~x����>������5���1���qj�����8[ �ថ�{���CO��I���ɰ�(�w%z���E�Ӌ|Щ5n�6�K��+���-�Mg�]��a�� �xX`g�5��Un[d��V�Z�JQ�⹈�nV�����L�v5#�׳`��w��{5�k�2o3|1���5�k����j�O˒,��t�@Z>[`���կ�Rs�A��z�����;�J�I���f�Km���vb|�$ ��Q��I`����^ѡ�� �nH�B�EN��F�Qs��T�r��S�b���k�q,���w��i��8@)!�0�Hp]�l�*ڷEP�} ���k�y�}����ȼ��EP-nO����y�\��D�N~Ɲ�7� ��Ь�݉+S�::}N>G~����N�tEl�V����B3{�[g���Eg��c�)�<cZ�6��F9vV��\���f�Dܙ�F�X�����z�)`��$�U�i���D�%Ӏ��+��{����k�5�Y��5O�eў�� w����.�!k���×;;��6YQ1.�k}w�m�O���f�3�(f���Th?�~M�C?!���m�x�d>]�/u����v��/@h��ۨ�)x�҇ �Fyv{Ybz�ݺ�;�ЕG_7�����f_��vCi����!�� J��= ���Ȼ�@�����k��u� ${�+�)�?�v�,����� �=b�ȹ�̇����[�g� 8�����PA���^��R1P Hݠ��M���!�b��o0 �I�]/0�u����dR���u���L�9��k��d0<���%>���$r�G�5X�7HB������Tx١0P���Ηlm2��d������BR���-^Ur��mܡ���:6�kW�ym1[1-���=<ǫ��3������5Bp�h��V��H��a1=���h��Nt�Up#�'�P�ꋳl@QPbE��+ Z�s���\���&�V�%���PSh��K q��*�[7N�v� �L�q�@nPh��r�R�x^�85R덁g���-H�Sf����Y��1B8l�A��X�DZE�i� ��������h@��e�H�a�m����\�T�a2�I�Smɮ�|��e1��8����J����:)�Ǹ��Vl�:h~ �NUE�z�ō���XF�1�(����_�M��ߺ�r��e"�^���Q& +��~�&��}���i�p��L_ߋ���U���%=g�j�Sۅ��B6��bϳ�c����5����U�������ΫP��mTL��S�HZ�����3sLv��p�^�),bhh�\�۾T�xo;��Pg6y'��5�P�50�z�9�����9 ���;��qo��\1G�j���'`н����AHe��Np��Nd��j��|�R����ԕb�dǺ��)7�j���:V�*�L�� Aj!���➆�o�us��T:��|�6�噺���Y`�h�4��v�]<����YF �T�#<���ߵ�Ns���C\���l\�W� ��6��sɷ�ϭ�L �?R�(��ti-Aq:��f}r*�W�Ia�Q�!&���C5Dv 8A����V��y�� �Q�n�P�� +]���9t�v!��5%|9{�[��$ًQ�zTQ(v�- j��h����͑8_�#��O �ټ�mMӀ�2IC�d�S�Z� ��k�� �H+$�,��I<���Ǖ�м�[��r0�Q"��l<��>�L`Z��hw���}O̰����Q�-*oS��x�c������K*�p���]5*���%�5����!���tP�`dHʴC�e8�G�xɒJ�4�j��I��%WB��9��`yP`����g8H���A>����D�%ِ���ߊ[�h����һ �0�f�6�1h�'��%@_Ϲ��X;�A)U�ۡp�U�x͝Yܾ�W/�uHv-gA����P=��:3�]�R��T7�n�0B ���U��RD��L�%�����}':�� �%�}�Bd���9~S"���?gyO��y��b�h�{+��+�g���_�+cU�e���j�ӖʟYR�F��8yyԥY9[<p������4=6=@���gq��Gʲ&�M!VUl�����.���$��\��1�U-F����Ο�6?N�d�\'�B���qm�FO=ST�P7�+�B3�Ἁ*o���*6�-ət3�1쥈+�cO o[���~���� Q�ѷ��_`��0�J�8������aĨ���5�� ��ȧ�Wy)l�lOq�>��I+խ�e[��:6���B'��B��������*+5n��i����jE�����Y�?O�����N�Q�'��r���oC�\�J�.��z@�Hp���T"� ��s9k�FXa��j`l��~��Xʎ��ǽA<�z�������v�m��ĜF��&'bi� =��*7��"Qd����V�45�|�(?�I�JM���I,�V6u��y������:�0�S����-@���:�����Oj�@�7"[����G=6���ù%�D����tI˝}��1i'�WڗI��u���qՊ~�����(����E��k��;� ߂{��Ѳ��#JI�nAq�4��L8ޘY�Z�@^��:N^�&���rP�������&�O(WoI���1�V�_K��~�K�3D�gihU����� b�>�AF�G��`���f�˧�� ���|=��с��:��s�E�q�=���3�g�����4�h�m�Mt��;��>'�v{oNz[��g������Q������ȋ���MU+�}�r_LG�8�C,���՚��TyM�uD�4̈�[���~$����f�A�E>���C6��b�x�r �Z�� ���\���|��kx���Bi�QF��✧sM<�0��j�7�믇>�4KX\�1��G���O���y�zk;�ӭI��73���x��:~[Y�r~��Cܚ}]mb�@♧�k��P���V��Q�]���+�_�S�t#P�'��I-�M���b�b��
Static task
static1
Behavioral task
behavioral1
Sample
HwidSpoofer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HwidSpoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
HwidSpoofer.exe
-
Size
10.7MB
-
MD5
7aa78d275533f51ec008efe15721caa5
-
SHA1
0045e6e9db94835c806d66018180c2617bc49df3
-
SHA256
09006c351a602ec9f5b10b3dd9feaab33d39eb78b58e0ce07e36d604e857c83a
-
SHA512
6083e4457f3ec295b12a327628075c854ff78837bbaafff3e702086b916dba93f50d1a06a6c2c7889e36ee05c5f8a8c00ae62330b1fcb57f4b41c549e568cc51
-
SSDEEP
196608:9oCJExnTVO4krxmNcGsDD7gXZ8HXyeTJZv5Bj8OQM2/XYkBlb:SCJEhZ2rxacFDAJBeT/7j8OQJXYkB1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HwidSpoofer.exe
Files
-
HwidSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 301KB - Virtual size: 11.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE