DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
Kernel Spoofer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Kernel Spoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
Kernel Spoofer.exe
-
Size
33.0MB
-
MD5
675299c7cbd1c2ae7c86beca9d060b80
-
SHA1
734ffde03ee9314be51ecdb5fadd12564fdd4f8f
-
SHA256
a5521fb06e0f3c87340aa70973243c95d9b611af0ee25fa5d834b48deeae1f96
-
SHA512
27ae3933337bebf49d7e7fd36402600aba02b8b9704070718a5a0629870df4579f4553359e4d295b48c59e3129073e9848c258b89b884c9fa8ba54492d0402d4
-
SSDEEP
786432:+OMatQD1ByJbCmIkj+znk6pI3cgelPTjqY+cbYk:yf1BcbCmOTkyI3ReleJk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Kernel Spoofer.exe
Files
-
Kernel Spoofer.exe.exe windows:6 windows x64 arch:x64
09f927dbf84bb0ffa458894140f1fc0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCloseKey
bcrypt
BCryptGenRandom
crypt32
CertNameToStrW
iphlpapi
GetAdaptersAddresses
kernel32
RtlPcToFileHeader
ncrypt
NCryptOpenKey
ole32
CoTaskMemFree
secur32
GetUserNameExW
ws2_32
GetAddrInfoW
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.o=B Size: - Virtual size: 22.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.i/S Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.B`b Size: 32.8MB - Virtual size: 32.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ