SolixSpoofer.zip
- SHA256 52990aa3f99e08348a4b784271d92be64048ecf543a4609ca81e364127d969b2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SolixSpoofer.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target SolixSpoofer.zip
- Size 1014KB
- Sample260625-m7t26sbs8r
- SHA256 52990aa3f99e08348a4b784271d92be64048ecf543a4609ca81e364127d969b2
- MD5 6aea317cc9f8f2c3f89349c44734a7f7
- SHA1 2bfdbb8cd78689e2ad88aed7b26edb0192853dee
- SHA512 76f649596e3f382720e58243b213b46a84ae5c3da8442f99ca9dd76bd07ee30007a4e3d61b043e4222dec8e8b6e85000463f170accaeed82c8be709304c6d270
- SSDEEP 24576:LGtpm8yFV5udcT+RR4XWG5X2CTqSMWmN9ffTLBkiuLe:LGG8ywuT+kXWGZT7MWmNlLBJuLe
- TLSH T1652533267047A8F73056147BD2192ECE148311E3CF88B252E0DDC7EABDA60B747D7969
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SolixSpoofer.exe
File Explorer
-
SolixSpoofer.zip.zip 1014KB
-
SolixSpoofer.exe.exe 983KB
-
SolixSpoofer.pdb3.8MB
SolixSpoofer.exe
- IMPHASH 843ae15e5d1e8259a65e9bb8101f8a1e
- SHA256 9a5345a1f3ac16c23654d8dc52fd5bd4b2f4b171ce40b62fdc05ca5363c3480a
- MD5 d1ea7a760895b1a0ddb0683ceebd1f68
- SHA1 4a97d3f87994f414690d46a52562e9c8e113a0f5
- SHA512 504f396853e5e4f1d737bb983cf203ee8c96dd1b526840f15a9e8659b7e72568a10143ddaf9a578fa8a9bf94fd1e1075da2a3d73b96fe704b33cadcbcbcfd851
- SSDEEP 6144:TljAXFgGgOrp94hYsMYLBwONHXovfZtJRznIdvfZGqeXW5wMy5:TljOgRjVUbIi
- TLSH T17B257566A6A665A4C07BC03CD552951EFD6034AA8338A2FF72C54E812F917F4EF3C781
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
395506
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\jakem\source\repos\SolixSpoofer\x64\Debug\SolixSpoofer.pdb
kernel32
WriteFile
GetTempPathW
CloseHandle
GetLastError
WaitForSingleObject
GetCurrentProcess
ExitProcess
CreateProcessW
GetModuleFileNameW
SetFilePointer
SetConsoleTextAttribute
SetConsoleTitleW
GetConsoleWindow
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleW
GetStartupInfoW
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetFileSize
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
ExpandEnvironmentStringsW
CopyFileW
GetStdHandle
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetProcAddress
user32
SetWindowLongPtrW
GetWindowLongPtrW
ShowWindow
SetWindowPos
SetWindowTextW
advapi32
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
msvcp140d
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?_Random_device@std@@YAIXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
vcruntime140d
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
__C_specific_handler_noexcept
__current_exception_context
__current_exception
memcmp
memchr
_CxxThrowException
__std_exception_destroy
wcsstr
memset
__std_exception_copy
memmove
memcpy
__vcrt_GetModuleFileNameW
__C_specific_handler
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
exit
_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initterm_e
_wmakepath_s
_wsplitpath_s
_initterm
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_CrtDbgReportW
_free_dbg
malloc
_callnewh
terminate
_rotl
strlen
_wcsicmp
wcslen
wcscmp
wcscpy_s
__stdio_common_vswprintf_s
_CrtDbgReport
_calloc_dbg
_crt_at_quick_exit
_get_initial_narrow_environment
_seh_filter_exe
Name
.textbss
Size
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
784KB
Virtual Size
783KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1024B
Virtual Size
618B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=35721,
count=11, id=260, version=35721,
count=36, id=261, version=35721,
count=6, id=257, version=35721,
count=9, id=257, version=33145,
count=159, id=1, productName=Unmarked objects,
count=1, id=261, version=36246,
count=1, id=255, version=36246,
count=1, id=258, version=36246,
SolixSpoofer.pdb
- SHA256 5fab2e0620da627defc93265bfe332a2909005cddde0a087b26b305fa5b52bfa
- MD5 bfc756e137f553609bae752f108af883
- SHA1 ddd459a9d7919fefb6c6e1e1c473da324ee801ad
- SHA512 82de5f9543bb95c48f5c2970917602295bbc9b9ab7c78bb21acde54082b89421c01b35c0578786f7fdf0aa46edf6e7499ad67b74b4a744a5fe64874f5a052315
- SSDEEP 98304:okvZ6ZbIuWZW8UtNqNnljHBkHBdHBgHBcHBoHBbHBPHBQHBmHBIHBvHB+HBrHBLZ:mY
- TLSH T1C7161977B5D1DC26C03F4739809B1E6D3338E8695BCEAE8B058859D91CEA3883E4F615
- MD5 SHA1 SHA512 SSDEEP TLSH