OceanWin Spoofer.zip
- SHA256 02853a08457699da43b4d464879fd75b5d42dd6f991f1b8d2cd21d2198d6c453
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OceanWin Spoofer/XD.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
OceanWin Spoofer/crack_attempt.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target OceanWin Spoofer.zip
- Size 36.0MB
- Sample250126-yclcbsslem
- SHA256 02853a08457699da43b4d464879fd75b5d42dd6f991f1b8d2cd21d2198d6c453
- MD5 f7ff5c0130ef8641515b0eeeb8a3b0a6
- SHA1 f47103ee993fbd4f19c732d985a691ed4ef666b2
- SHA512 74a65f888b8f6d9f08e6db4d4f154aa13b00c37c7ba91e0c7103ef40914df13d7f54da3f4fce22f47e94839d76fe4a0bcb36d8b50014f66f80cbef82ce2ff16e
- SSDEEP 786432:M1qBtE9egeCmA3tGeW9i4LWugR7EdZGPfn8NSBUncEwp0:qStE6CmAwf9i4P/GZqnqe
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/OceanWin Spoofer/XD.exe unpack001/OceanWin Spoofer/crack_attempt.ldr
File Explorer
-
OceanWin Spoofer.zip.zip 36.0MB
-
OceanWin Spoofer/XD.exe.exe 13.8MB
-
OceanWin Spoofer/crack_attempt.ldr.exe 26.9MB
OceanWin Spoofer/XD.exe
- IMPHASH 79cf67b70d66b070f3ade58f2954986b
- SHA256 68756011ba8e14bef18e188b2a5f5dccbcb0d6c4aa552c99fcde41887f828175
- MD5 6801fb25d54fd349f808761373217ab6
- SHA1 3889ca95f780abb77d0655d2ec886f79169ba3f2
- SHA512 e45418f75c6466ceb55a122c31563096f7e4f2a621976617c17099ecf9664a6cc53da398e745205d62633a53f396020e792863ed729f4bf46ae6d02fe932b3ee
- SSDEEP 393216:ogJ1H45414sRe+kGt+vOX+UiywBDzHJki4:BLHGt+F+vlUi1HJO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12514463
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Module32Next
advapi32
LookupPrivilegeValueA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
OceanWin Spoofer/crack_attempt.ldr
- IMPHASH 4886b8fb5b4471466e2ecd47320efc72
- SHA256 73f555f1c1c64c713791393cf2f10ad24b6f5b1f94bc9c207c03cfe9bb5a63fe
- MD5 d5cd8a8e7badcdba42b2437b7585d0da
- SHA1 06603e938b306bba5978d3e32d1fb15241bdadfd
- SHA512 8b3b9a8670c367a268304b59bcedace897601162474f347fc90d591958af65a46b3d5622d6ead56859ae533b8c237632eaedbc1e55ccbbc4d4b10673a0c39c9a
- SSDEEP 393216:YY0pntXIgoibDuIUx5hsYUXoKzEuYT1EtrqnR+ks0DvPROMgm2ej+WC:YtpFoQuICmyuYS5qR+kvDvcMgm2ej+b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
35982863
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateFileMappingW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ShowWindow
advapi32
CryptImportKey
ole32
CoSetProxyBlanket
oleaut32
VariantClear
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
iphlpapi
GetAdaptersInfo
winhttp
WinHttpQueryDataAvailable
ntdll
RtlVirtualUnwind
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertGetCertificateChain
ws2_32
listen
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
ceilf
shell32
ShellExecuteA
Name
.text
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.%Wu
Size
Virtual Size
15.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.}cn
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.$WQ
Size
26.7MB
Virtual Size
26.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ