hwidspoof_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hwidspoof_x64.exe
Size 18.2MB
Sample260710-e25byscz6n
SHA256 6052dae9db2423a9e56ec9162fa92d63bf69e6818a971394a8931ed0c507d291
MD5 0d1471e20947315b4e791c1e860a10d6
SHA1 f207735343f12644e136e2296c372e30f99579b6
SHA512 63512268acb5ba5e7bccb827303d3b0c99a787b952e6bffc50a14eaa6726f4e98dd441c0823af92aebefa038f91520a189db4bb3cff55ea3c62e6d4ac451edc3
SSDEEP 196608:684ZbQI9U1zpCfxwNrmvxQiLntezRKMveE7yuGYp3MUqCrdjMWZ9I95X/K9Tb7n:BDrAfxMqvxhYzRtp7yZwnrNPqTXUH7
TLSH
T15D17D043F2A295ECD06AC074935A7633FA327C4D43357AEB5BD04A213F69F906A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hwidspoof_x64.exe

File Explorer

hwidspoof_x64.exe

.exe 18.2MB

hwidspoof_x64.exe

IMPHASH d28c7b0fed0520c28c89f588dc589a20
SHA256 6052dae9db2423a9e56ec9162fa92d63bf69e6818a971394a8931ed0c507d291
MD5 0d1471e20947315b4e791c1e860a10d6
SHA1 f207735343f12644e136e2296c372e30f99579b6
SHA512 63512268acb5ba5e7bccb827303d3b0c99a787b952e6bffc50a14eaa6726f4e98dd441c0823af92aebefa038f91520a189db4bb3cff55ea3c62e6d4ac451edc3
SSDEEP 196608:684ZbQI9U1zpCfxwNrmvxQiLntezRKMveE7yuGYp3MUqCrdjMWZ9I95X/K9Tb7n:BDrAfxMqvxhYzRtp7yZwnrNPqTXUH7
TLSH
T15D17D043F2A295ECD06AC074935A7633FA327C4D43357AEB5BD04A213F69F906A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6651568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hwspoof.pdb

kernel32

SetFileInformationByHandle GlobalFree GetStartupInfoW GetSystemTimeAsFileTime FlsAlloc GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId CreateEventA GetFullPathNameW CreateFileW WaitForSingleObjectEx SetLastError CreateDirectoryW FreeLibrary CreateIoCompletionPort SetThreadErrorMode LoadLibraryExW GetModuleHandleA PostQueuedCompletionStatus GlobalMemoryStatusEx FlsSetValue LocalFree Sleep GetQueuedCompletionStatusEx DuplicateHandle GetCurrentProcess FlsGetValue GetFileInformationByHandle GetFileInformationByHandleEx GetProcessIoCounters GetSystemTimes SetFilePointerEx FindClose FindFirstFileExW GetCurrentThread SetThreadStackGuarantee GetSystemTimePreciseAsFileTime FlsFree WriteFile TerminateProcess IsProcessorFeaturePresent SetStdHandle GetFileType OpenProcess FlushFileBuffers GetModuleFileNameW GetProcessTimes GetModuleHandleExW WaitForSingleObject ExitProcess CreateThread GetSystemInfo GetProcAddress GetLastError SwitchToThread CloseHandle GetCurrentThreadId FindNextFileW WriteConsoleW GetTimeZoneInformationForYear QueryPerformanceCounter LoadLibraryExA GlobalAlloc GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter GlobalUnlock GetCommandLineW GetCommandLineA DeleteCriticalSection GlobalSize InitializeCriticalSectionEx GlobalLock LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RemoveVectoredExceptionHandler SetUnhandledExceptionFilter InitializeSListHead HeapSize LCMapStringW K32GetPerformanceInfo VirtualQueryEx ReadProcessMemory GetProcessHeap QueryPerformanceFrequency GetModuleHandleW GetEnvironmentVariableW HeapAlloc MultiByteToWideChar lstrlenW LoadLibraryA GetCurrentDirectoryW VirtualProtect MapViewOfFile CreateFileMappingW GetUserPreferredUILanguages UnmapViewOfFile WideCharToMultiByte FormatMessageW AddVectoredExceptionHandler IsDebuggerPresent HeapReAlloc HeapFree CompareStringW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

ClipCursor RegisterWindowMessageA AdjustWindowRectEx GetWindowRect ShowCursor SystemParametersInfoA GetClipCursor ShowWindow GetWindowLongW PostMessageW GetWindowLongPtrW DefWindowProcA RegisterClassExA CreateWindowExA DestroyIcon ReleaseDC InvalidateRgn SetWindowPlacement ChangeDisplaySettingsExW SetWindowPos GetCursorPos MonitorFromRect GetWindowPlacement ScreenToClient GetMenu SetCursor LoadCursorW SetWindowTextW CreateIcon ValidateRect IsProcessDPIAware SetWindowDisplayAffinity GetDC GetSystemMetrics DefWindowProcW DispatchMessageW TranslateMessage KillTimer SetTimer GetMessageW PeekMessageW RedrawWindow GetMonitorInfoW MonitorFromPoint DestroyWindow SetWindowLongPtrW CreateWindowExW RegisterClassExW SendMessageW MonitorFromWindow TrackPopupMenu SetMenuDefaultItem EnableMenuItem GetSystemMenu ClientToScreen SetForegroundWindow GetForegroundWindow IsIconic GetClientRect IsWindowVisible FlashWindowEx SetWindowLongW GetActiveWindow GetKeyState RegisterTouchWindow GetClipboardData CloseTouchInputHandle GetTouchInputInfo GetKeyboardState GetAsyncKeyState GetRawInputData SetCapture GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx OpenClipboard MapVirtualKeyW SendInput EmptyClipboard CloseClipboard SetClipboardData TrackMouseEvent ReleaseCapture RegisterRawInputDevices

gdi32

DeleteObject CreateCompatibleDC GetDeviceCaps BitBlt CreateDIBSection CreateRectRgn SelectObject DeleteDC GetPixelFormat ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers

shell32

CommandLineToArgvW DragQueryFileW DragFinish ShellExecuteW

ntdll

NtQueryInformationProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtReadFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlUnwindEx RtlPcToFileHeader NtWriteFile NtQuerySystemInformation

advapi32

GetLengthSid RevertToSelf ImpersonateAnonymousToken GetTokenInformation OpenProcessToken CopySid IsValidSid SystemFunction036

oleaut32

SysStringLen GetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

pdh

PdhCloseQuery PdhAddEnglishCounterW PdhRemoveCounter PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmAssociateContextEx

ole32

RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize OleInitialize

opengl32

wglGetProcAddress wglDeleteContext wglMakeCurrent wglCreateContext wglGetCurrentContext

psapi

GetProcessMemoryInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

d3dcompiler_47

D3DCompile

uxtheme

SetWindowTheme

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hwidspoof_x64.exe

kernel32

api-ms-win-core-synch-l1-2-0

user32

gdi32

shell32

ntdll

advapi32

oleaut32

bcryptprimitives

bcrypt

pdh

dwmapi

imm32

ole32

opengl32

psapi

powrprof

d3dcompiler_47

uxtheme

generic