Harddrive null spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Harddrive null spoofer.exe
Size 226KB
Sample260707-cwlljsf12t
SHA256 b46d670bff2e581e3c6cfaba40de7328194dd2f6b7b6e2af8c0780f692ae6dd0
MD5 5368be6495b27eaa1ecee134062b7849
SHA1 362c56ff3625650166798c170408459bea0c4245
SHA512 9c02e031baf319db2c50c071a70d7f0abd000e8eb5d70242341bc0ecfad2d0f19278f13a276fa23a72a833d8ebba2650a71ca6f4f6a980c3ff1f59403ad17ca4
SSDEEP 3072:qBIIvK2CRz3GaO5D9Yl5m5JM8gqqLqqLqqLqqCfff3HOzc0kGQF:qBIfw5K8gqqLqqLqqLqqkHT
TLSH
T17A340A8B762512F0C47DC039E092257AFEB278A2037167DB4295A6171FA37F4AE3E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Harddrive null spoofer.exe

File Explorer

Harddrive null spoofer.exe

.exe 226KB

Harddrive null spoofer.exe

IMPHASH bf1b05cb026816a13fe28da6dbba95f4
SHA256 b46d670bff2e581e3c6cfaba40de7328194dd2f6b7b6e2af8c0780f692ae6dd0
MD5 5368be6495b27eaa1ecee134062b7849
SHA1 362c56ff3625650166798c170408459bea0c4245
SHA512 9c02e031baf319db2c50c071a70d7f0abd000e8eb5d70242341bc0ecfad2d0f19278f13a276fa23a72a833d8ebba2650a71ca6f4f6a980c3ff1f59403ad17ca4
SSDEEP 3072:qBIIvK2CRz3GaO5D9Yl5m5JM8gqqLqqLqqLqqCfff3HOzc0kGQF:qBIfw5K8gqqLqqLqqLqqkHT
TLSH
T17A340A8B762512F0C47DC039E092257AFEB278A2037167DB4295A6171FA37F4AE3E705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\d\Desktop\valencia\x64\Release\valencia.pdb

kernel32

GetProcAddress CloseHandle FormatMessageA LoadLibraryA CreateFileA LoadLibraryExA VirtualAlloc DeviceIoControl GetCurrentProcess VirtualQuery VirtualFree CreateFileW GetFileAttributesW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetLastError MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime LocalFree InitializeSListHead

advapi32

RegCreateKeyA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegOpenKeyA RegDeleteKeyA RegQueryValueExA RegSetValueExA OpenProcessToken RegOpenKeyExA

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Syserror_map@std@@YAPEBDH@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_unlock _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ

ntdll

RtlInitAnsiString NtUnloadDriver NtQuerySystemInformation RtlAnsiStringToUnicodeString NtLoadDriver

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memset __current_exception_context __current_exception __C_specific_handler __std_exception_copy __std_exception_destroy memchr memcmp memmove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _fseeki64 fread fsetpos getchar ungetc _set_fmode fputc setvbuf fgetpos fwrite __p__commode __stdio_common_vfprintf fgetc __acrt_iob_func fclose fflush

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _get_initial_narrow_environment _c_exit _set_app_type _initterm exit _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback __p___argv _seh_filter_exe _invalid_parameter_noinfo_noreturn terminate _beginthreadex __p___argc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr