Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spoofer.exe
Size 2.6MB
Sample260621-2p7ymsgx2v
SHA256 d40dc9ec509ed5d6e1a4b3eb9e27205ad87f88ec24720c0ca8d82337c0e8bb70
MD5 46c8ddb17ccdaa3df0f8d7361b9122fe
SHA1 601363dcdd6bd9c7393a615c054f4926600380db
SHA512 6aaf3a4439c693d310ed4bafed28ab5f8bd8ac3ccfaf9f88f361de6236a07ece1e9ee407c59eea6fe4b349a175fd030e28976f966a6431948050d89009f16ecf
SSDEEP 49152:yFlezrYdfxuULsacW8ynARVd1RbQrcLR39TaWJ44:slWUfXL2VHRbQAJI4
TLSH
T146D5AE56FEEA945DC36E903491099BBBD772F4100720FAF721D446AA7BB68C0697C323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

File Explorer

Spoofer.exe

.exe 2.6MB

Spoofer.exe

IMPHASH 543ed8918d995c3b2310c578da804581
SHA256 d40dc9ec509ed5d6e1a4b3eb9e27205ad87f88ec24720c0ca8d82337c0e8bb70
MD5 46c8ddb17ccdaa3df0f8d7361b9122fe
SHA1 601363dcdd6bd9c7393a615c054f4926600380db
SHA512 6aaf3a4439c693d310ed4bafed28ab5f8bd8ac3ccfaf9f88f361de6236a07ece1e9ee407c59eea6fe4b349a175fd030e28976f966a6431948050d89009f16ecf
SSDEEP 49152:yFlezrYdfxuULsacW8ynARVd1RbQrcLR39TaWJ44:slWUfXL2VHRbQAJI4
TLSH
T146D5AE56FEEA945DC36E903491099BBBD772F4100720FAF721D446AA7BB68C0697C323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

714912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Valoooo\Desktop\Saturn Spoofer UI\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

FindResourceW GetCurrentProcessId CreateDirectoryA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetModuleHandleW Sleep CloseHandle WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LoadResource LockResource GetTempPathA WaitForSingleObject SleepConditionVariableSRW FreeLibrary GetProcAddress SizeofResource LoadLibraryW SetUnhandledExceptionFilter QueryPerformanceCounter GetStartupInfoW

user32

GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos SetLayeredWindowAttributes GetCursorPos GetKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData PeekMessageW SetWindowLongA DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW DestroyWindow DefWindowProcW PostQuitMessage UpdateWindow GetWindowRect MoveWindow GetSystemMetrics GetWindowLongW TranslateMessage

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA ShellExecuteA

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??7ios_base@std@@QEBA_NXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException __std_terminate __std_exception_destroy __std_exception_copy strstr strrchr longjmp memcpy memmove memchr memset

api-ms-win-crt-runtime-l1-1-0

terminate exit _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode fflush _set_fmode fputc fclose __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vsprintf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell fgetc _get_stream_buffer_pointers _fseeki64 fread fsetpos fgetpos fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

strncpy strlen strcmp strncmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrtf acosf ceilf cosf fmodf sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale