Grey Spoofer.rar
- SHA256 5847451fe92ade8277599206f2d3ec904eef8e396bb5a6a6c988912e579dfacf
Static task
static1
Behavioral task
behavioral1
Sample
Grey Spoofer/Grey Spoofer.bat
Resource
win11-20250619-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Grey Spoofer/obsidium64.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
batch_interpreter.py
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Grey Spoofer.rar
- Size 2.5MB
- Sample250720-pkafcszzet
- SHA256 5847451fe92ade8277599206f2d3ec904eef8e396bb5a6a6c988912e579dfacf
- MD5 2b90cec4759e9f86c509c9c41055aaa0
- SHA1 c0d09779ecf4f222b8a3bbc95769099bc73c1b8c
- SHA512 8987e7ab5521f6b67b8ecb18cbd10b5419609d68242ce9cdd6283aa919dd1a68e2649e340e6bb188781e6de506192e26afabac4fa8f70209ddd37234869fc91d
- SSDEEP 49152:omSxIMm1XK8VIWzPLaOPQPJIs8RU45V13Ul1AC5FO6rGIAkXJaBofyq3BY3noF+4:oHqMm1XK8VI8aOkh8a+V1El1AC5FO6HP
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
Grey Spoofer.rar.rar 2.5MB
-
Grey Spoofer/Grey Spoofer.bat2.9MB
-
Grey Spoofer/imgui.ini95B
-
Grey Spoofer/obsidium64.dll.dll 312KB
-
batch_interpreter.py32KB
Grey Spoofer/Grey Spoofer.bat
- SHA256 b4bf087bdd0c8a6ed7fba9be38b8de366d10bdb158d84200707e534fa007172d
- MD5 7dcc87628bb7afaa189f653dd1fe2f37
- SHA1 f4fa42b50217a3c5c484ede5c4b41fa0b65ee573
- SHA512 3ce8b93c243d684846c64f706c7f5ff954d8436c398fcd27da401bb1b5553fc8b878d5408a2568e4453b8950eb6a8ea88106760ab7859967c9acaed33b51a0a5
- SSDEEP 24576:VMkmMN6caU80VAwCxHrWIDlCNMe/81g7kr/LHYGCPVGuVbMVhzMGhQUcjJ+L88su:arcYDlCespDVcheoW7lJXECU
- MD5 SHA1 SHA512 SSDEEP
Grey Spoofer/imgui.ini
- SHA256 5497c0ab609cf1ddc7623e2b5db8e26fce9b99669a4b97cefe2b169b5822c627
- MD5 add7c36d1f354ebb5438cfffa3c46b29
- SHA1 c129d3e586994be3e206463d6fef4e03176dc0d8
- SHA512 b5052ac524c2cbb12e4b6d4947a628e88fc8a77588856e889bf534b9e892e65023455c47ddde8509b9843383892aa2ebe2ae2ca6c5e594da6db6e2a5a98a09b7
- MD5 SHA1 SHA512
Grey Spoofer/obsidium64.dll
- IMPHASH da74a7101e6d219a0c25a2f046be4fca
- SHA256 6d8361489584a1d7f657d5c62b3d5ecc5c4277eb22304dc8557597cd5e494fab
- MD5 04309f41d97720db02726c018f2c885f
- SHA1 1dce4a32292f1bf5d0de9eb906ae1dba9bc247a8
- SHA512 355727bedbd8b1041ee963f48d9567609521e83a53822b53495310e900df52a39c5530725ceb1f9622eeb9b202d80bd3202e753a9d8fa0c00873fe0282472906
- SSDEEP 6144:cd/WbSly6M50creIhrx0nOWK52d5B7GFQkQcF2DYhftO26N7IsL0V:QZ46M5NPt0OWK5K51GQkNhfA26N7rQV
- MD5 SHA1 SHA512 SSDEEP
Digest
a8:2a:22:94:d3:d8:c2:c6:cd:ed:1b:cc:df:10:81:70:72:30:2a:2f:85:8c:fa:ed:49:51:89:0e:33:95:a1:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE
Chains
Oct 18, 2023
CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE
Serial Number
5a:34:a5:b6:36:56:3d:f6:b7:a1:f0:7f:b5:f2:39:79
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 8, 2022 - Jan 9, 2026
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
408056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
EnumSystemLocalesW
GetModuleHandleA
shell32
SHChangeNotifyRegister
advapi32
RegOpenKeyExW
user32
DefWindowProcA
obsBlacklistLicenses
obsConvertLicenseToBinary
obsConvertLicenseToString
obsDecTrialCounter
obsDeleteLicenseData
obsDeleteTrialData
obsDisableLicense
obsEncDecData
obsGetActiveLicensingSystem
obsGetCustomValue
obsGetExpirationDate
obsGetInitialTrialCounter
obsGetInitialTrialDays
obsGetInitialTrialRuns
obsGetInstanceCount
obsGetLicenseCreation
obsGetLicenseData
obsGetLicenseExpiration
obsGetLicenseHash
obsGetLicenseInfo
obsGetLicenseInfoEx
obsGetLicenseInfoExW
obsGetLicenseInfoW
obsGetLicenseStatus
obsGetLicenseSystemId
obsGetProtectionDate
obsGetSystemId
obsGetTrialCounter
obsGetTrialDays
obsGetTrialEndDate
obsGetTrialIdentifier
obsGetTrialRuns
obsIsLicensed
obsIsProtected
obsIsVm
obsNetLicConnect
obsNetLicDisconnect
obsNetLicGetAppCertId
obsNetLicGetAppCertName
obsNetLicGetAppCertUserData
obsNetLicRegisterCallback
obsReloadLicense
obsReprotectString
obsSecureString
obsSecureStringW
obsSetExternalKey
obsSetLicense
obsSetLicenseShort
obsSetLicenseShortW
obsSetLicenseW
obsStoreLicense
obsStoreLicenseShort
obsStoreLicenseShortW
obsStoreLicenseW
obsUsbDecrypt
obsUsbEncrypt
obsUsbEnumDevices
obsUsbExecute
obsUsbGetDeviceId
obsUsbGetLicenseDeviceId
obsUsbReadData
obsUsbRegisterCallback
obsUsbWriteData
obsVerifyLicense
obsVerifyLicenseShort
obsVerifyLicenseShortW
obsVerifySignatureData
obsVerifySignatureFile
obsVerifySignatureFileW
Name
.text
Size
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pexe
Size
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
Name
.pexe
Size
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
batch_interpreter.py
- SHA256 4b6b08f8639487b0f69788419f404a2f60b8f3f4327fef928f2fbefeb14c6be4
- MD5 0da4aeafc919996d9221df4a5750f6eb
- SHA1 feef7d942ddb9659175f47dfad77cd909abc0b23
- SHA512 0a5e2bbdeb2778469b5fa2b21a298ca6392783b4cd822a9f2cb3af454023fbfaa2a2517e556ef1bd900475a2e73afd71cdea9dca40681f093b04c5b74af010ac
- SSDEEP 768:9PdsvDKnuqmiZFHFXohle4DrJr41HKKzQ5d:JfVuLh41HJC
- MD5 SHA1 SHA512 SSDEEP