Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spoofer.exe
Size 1.7MB
Sample260503-vxjgpaew21
SHA256 2281f218252015016f91d6d75dcfea504b3ed50ec11366221c5dcab426f30501
MD5 b7a651940e399c87a9ee031004409bb1
SHA1 44ad3b1fb2df2fe8eed41960abc126bf2e3b35c3
SHA512 2b1642043d65b1b381e270813a2e550c7ec4260a7984a9223bf9529790911b31252e1082945dca43234b12583d9f4ac40d6105afeda90bcd507ae311f82d5390
SSDEEP 24576:oofeYncu+gbtW9qEUcH3+yAZjcbEMc/2Gu5stGxmjOvxuKPOY/ct9Xms48icdN8s:zbhD7eCq2rCV7
TLSH
T17B857CEC419C46BCE352D638A58A5787F7F3BE8E96A8EFBA1AD05CA14C1F080F535441
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

File Explorer

Spoofer.exe

.exe 1.7MB

Spoofer.exe

IMPHASH 67049f68fcb5d5815b8e92cf74cdfd8b
SHA256 2281f218252015016f91d6d75dcfea504b3ed50ec11366221c5dcab426f30501
MD5 b7a651940e399c87a9ee031004409bb1
SHA1 44ad3b1fb2df2fe8eed41960abc126bf2e3b35c3
SHA512 2b1642043d65b1b381e270813a2e550c7ec4260a7984a9223bf9529790911b31252e1082945dca43234b12583d9f4ac40d6105afeda90bcd507ae311f82d5390
SSDEEP 24576:oofeYncu+gbtW9qEUcH3+yAZjcbEMc/2Gu5stGxmjOvxuKPOY/ct9Xms48icdN8s:zbhD7eCq2rCV7
TLSH
T17B857CEC419C46BCE352D638A58A5787F7F3BE8E96A8EFBA1AD05CA14C1F080F535441
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1685708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\madar\Desktop\Temp\Temp\x64\Release\Spoofer.pdb

kernel32

GetFileAttributesW GetLastError CreateToolhelp32Snapshot Process32NextW Process32FirstW CreateDirectoryW GetProcAddress GetModuleHandleW FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar ExpandEnvironmentStringsW SetConsoleOutputCP SetConsoleCP Beep GetConsoleMode Sleep SetConsoleMode GetStdHandle CloseHandle SetConsoleTitleA GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetFileInformationByHandleEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter LocalFree

user32

CharLowerBuffW MessageBoxW

advapi32

RegQueryValueExA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegEnumValueW RegQueryValueExW

shell32

SHGetFolderPathW SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize

msvcp140

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA _Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ _Query_perf_counter ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memcpy __std_terminate __std_exception_destroy __std_exception_copy memcmp

api-ms-win-crt-runtime-l1-1-0

__p___argv _c_exit _register_thread_local_exe_atexit_callback _exit __p___argc _initterm_e abort _set_app_type _configure_narrow_argv exit _initialize_narrow_environment _seh_filter_exe _initterm _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _invoke_watson terminate system

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _wfopen_s fclose fseek __stdio_common_vsprintf_s fwrite fputc _set_fmode fflush ftell __p__commode _get_stream_buffer_pointers _fseeki64 fsetpos ungetc _popen setvbuf fgetpos fgets fgetc _pclose fread

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-crt-string-l1-1-0

tolower _wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr