updated.rar
- SHA256 f633427f634eac2dbd4fbfe59cda8bc16ec85b785d410753fd2cef5ecbd386f3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Zy's Spoofer.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target updated.rar
- Size 2.2MB
- Sample260620-sp4fsafw9k
- SHA256 f633427f634eac2dbd4fbfe59cda8bc16ec85b785d410753fd2cef5ecbd386f3
- MD5 88cc65f41b3f3db0187ed1d3f4d68b4b
- SHA1 00c3fbc9c3d0f5acdac571b4be2d81830c03449b
- SHA512 f0a64cbd900f034e86a9478712d8bc092504eac496a3aa46e607b327738f6f58eea4c56a3c126cf923d6bcc07d0515c8c0c97d4b81d8d58fdaa7971a6458e4d5
- SSDEEP 49152:5elIfpX7NvhGapikMbJ1k6da31//YKpgV9vBB2Z4c6Ufu5U2GNB:sqfpHBpiv1kY2BPWB2ZcUp2GNB
- TLSH T174B53342960E75DC2902D8702F3D23AE57D3B1756873835A5DE7EC98C019F3AA978FA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Zy's Spoofer.exe
File Explorer
-
updated.rar.rar 2.2MB
-
Zy's Spoofer.exe.exe 5.1MB
-
offsets.json7KB
Zy's Spoofer.exe
- IMPHASH 4984f208a64faed7ed680aeab7b1faa1
- SHA256 89e630e658ac61b97acf33711a8de856e5d09e641465533c13fbfae913c722e4
- MD5 fadbb0ee0ddc9cca7abd3041efe18063
- SHA1 ef36df401b19fba05eaa42d22a3d4f3a55aadb69
- SHA512 ba819715256a09e3fd03e16a63c5832b2fc1a95d54ad947db5943baa74e7664689d968eccf25f48b076ff01bb8a3677544363a4f52649e5095be287d524864de
- SSDEEP 98304:q5Fepk9x9M974o/Y7mgTm05AwJHE6hllolZqL9PlF:6epcL67dg7PAmkmaZqL1lF
- TLSH T13746AE42B392C1A9C166C238CA42D7A7D7323C090F2167EB369C7E1E6F726D05E79B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5259264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlPcToFileHeader
RtlCaptureContext
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
VerSetConditionMask
RtlUnwind
kernel32
Sleep
SwitchToThread
GetConsoleWindow
Module32Next
GetProcessId
Module32First
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
lstrcmpiW
SetThreadPriority
GetCurrentThread
ReadProcessMemory
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetConsoleMode
QueryFullProcessImageNameW
SetConsoleOutputCP
GetExitCodeProcess
DeleteFileA
CreateDirectoryA
GetComputerNameA
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameW
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
GlobalUnlock
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
GetSystemTimeAsFileTime
GetCPInfo
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
LCMapStringEx
GetFileInformationByHandleEx
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
GetModuleHandleW
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
AreFileApisANSI
SetFileInformationByHandle
SetEndOfFile
GetFileType
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
SetFilePointerEx
ReadConsoleW
InitializeSListHead
GetACP
CreateProcessW
WaitForSingleObject
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
ReleaseSRWLockShared
AcquireSRWLockShared
SleepConditionVariableSRW
GetTickCount64
RaiseException
IsProcessorFeaturePresent
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
FormatMessageA
WakeAllConditionVariable
LocalFree
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
user32
GetCursorPos
GetAsyncKeyState
SetCursorPos
ReleaseDC
ReleaseCapture
MonitorFromPoint
DispatchMessageA
GetWindowRect
DestroyWindow
GetSystemMetrics
SetWindowLongA
SetWindowDisplayAffinity
MessageBoxA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetWindowThreadProcessId
IsWindow
EnumWindows
IsWindowVisible
ShowWindow
SetForegroundWindow
FindWindowA
SendInput
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
LoadCursorA
GetDC
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
gdi32
GetDeviceCaps
advapi32
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptReleaseContext
GetUserNameA
CryptAcquireContextA
CryptGetHashParam
shell32
ShellExecuteA
SHGetFolderPathA
ShellExecuteW
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
winmm
timeBeginPeriod
PlaySoundA
winhttp
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rcd7cb
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=33, id=260, version=27412,
count=25, id=259, version=27412,
count=189, id=261, version=27412,
count=1, id=262, version=27412,
count=1, id=253, version=35207,
count=19, id=260, version=35207,
count=14, id=259, version=35207,
count=109, id=261, version=35207,
count=2, id=156, version=21202,
count=27, id=260, version=32822,
count=29, id=257, version=27412,
count=287, id=1, productName=Unmarked objects,
count=74, id=265, version=35226,
count=1, id=259, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,
offsets.json
- SHA256 aac2b933c1de939e0b44c318a38728f451eaa7351968039455e1752dd1e277bf
- MD5 9475c43f3996ff278d2a771f8c7cb13f
- SHA1 8723a8de5ceda82ca0c384f62716fd52a393ad9c
- SHA512 fee477e3583bbc9e4e50d43a962dd20cb67f77db1e1ae9ebb06ebe0c9d2c857a151c646246add974024965c99e5fa73853861b1a3c4f2679d71b0284170c3b5c
- SSDEEP 192:uKjUNQ+CI4Q+X8P9GBq33BKzw482bPE2/ZE7:uKKQSbl6q33BKEH2bPEsE7
- TLSH T1E8F1A540EEA57DBA1C2AF7B9065F75D39CBA746551071F99B4ECC20C20C852E3689B0A
- MD5 SHA1 SHA512 SSDEEP TLSH