FiveM Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FiveM Spoofer.exe
Size 3.6MB
Sample260715-lnf6jact51
SHA256 0878352b877282eec2bdc4d23bb4f4f1cfbcf10a61ffd2c94750d86f09c07434
MD5 f523c926cb70cf638e98e0af7ce83148
SHA1 75f2cb34ea5446f1cab1787f3d52a4b82112759b
SHA512 5f90c7d6842bc46bc8024c24988aad37099cb991a19090e393a1471080835e5dfff06dd39cc3fde890eda639762a3bc9b546b48bcfaa67640984d260c61fdce8
SSDEEP 49152:7b2cF8JBlThFdXRsWdyoaZUnDVga0lOgdJWihLNKVGaaqa4ovGYkuG:nW11wDLNua4ovGYku
TLSH
T18D069E2433AB2810C972EC3898AEE7EE82D2AD604B5787CF654561AC1E338F55777D43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FiveM Spoofer.exe

File Explorer

FiveM Spoofer.exe

.exe 3.6MB

FiveM Spoofer.exe

IMPHASH 369ef9fecd4f80395b26a24ae6831bed
SHA256 0878352b877282eec2bdc4d23bb4f4f1cfbcf10a61ffd2c94750d86f09c07434
MD5 f523c926cb70cf638e98e0af7ce83148
SHA1 75f2cb34ea5446f1cab1787f3d52a4b82112759b
SHA512 5f90c7d6842bc46bc8024c24988aad37099cb991a19090e393a1471080835e5dfff06dd39cc3fde890eda639762a3bc9b546b48bcfaa67640984d260c61fdce8
SSDEEP 49152:7b2cF8JBlThFdXRsWdyoaZUnDVga0lOgdJWihLNKVGaaqa4ovGYkuG:nW11wDLNua4ovGYku
TLSH
T18D069E2433AB2810C972EC3898AEE7EE82D2AD604B5787CF654561AC1E338F55777D43
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8071

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\FiveM Spoofer\x64\Release\FiveM Spoofer.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenRandom BCryptDecrypt BCryptHash BCryptImportKey BCryptDestroyKey BCryptCreateHash BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash BCryptFinishHash

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetOption WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpOpenRequest

crypt32

CryptStringToBinaryA CryptBinaryToStringA

kernel32

SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW WakeAllConditionVariable AcquireSRWLockExclusive GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError GetLocaleInfoA LocalFree GetCurrentProcessId ReleaseSRWLockExclusive GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte GetCommandLineW DeleteFileA GetTempPathA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess ExitProcess GetExitCodeProcess CreateProcessA GlobalMemoryStatusEx GetSystemInfo GetTickCount64 VirtualProtect GetModuleFileNameA GetModuleHandleW LoadResource LockResource SizeofResource GlobalSize FindResourceA CopyFileA GetComputerNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushInstructionCache VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA

user32

EmptyClipboard CloseClipboard DispatchMessageW PeekMessageW DefWindowProcW GetClipboardData SetClipboardData TranslateMessage PostQuitMessage SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout MessageBoxA AdjustWindowRect ReleaseDC GetDC UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW OpenClipboard

gdi32

BitBlt CreateCompatibleBitmap GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateRectRgn

advapi32

GetUserNameA

shell32

ShellExecuteA

ole32

CoUninitialize GetHGlobalFromStream CreateStreamOnHGlobal CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

CreateErrorInfo SysAllocString SysFreeString GetErrorInfo VariantInit VariantChangeType SetErrorInfo VariantClear

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setf@ios_base@std@@QEAAHHH@Z _Xtime_get_ticks ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ??1_Lockit@std@@QEAA@XZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Thrd_join ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ _Thrd_id

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpOpenRequestW InternetOpenW HttpSendRequestW InternetCloseHandle

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

vcruntime140

_CxxThrowException __C_specific_handler __std_exception_copy __current_exception __current_exception_context __std_type_info_destroy_list _purecall __std_exception_destroy wcsstr memcmp strchr memset memmove memcpy memchr strstr __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s setvbuf _fseeki64 fsetpos fputc fgetpos fgetc _get_stream_buffer_pointers __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fwrite ftell fseek fopen_s fread fflush fclose _wfopen __acrt_iob_func ungetc __p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc realloc calloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

atan2f _dsign ceilf pow log __setusermatherr logf acosf cosf fmodf sqrtf sinf powf floorf _dclass

api-ms-win-crt-string-l1-1-0

tolower isalnum wcslen wcscpy_s wcscat_s strncmp toupper strncpy strlen strcmp

api-ms-win-crt-convert-l1-1-0

strtoll strtoull atof strtod

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_exit _crt_at_quick_exit _initterm __p___argc _seh_filter_exe __p___argv _cexit _crt_atexit _seh_filter_dll _configure_narrow_argv _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback exit _errno _set_app_type _beginthreadex terminate _execute_onexit_table _initterm_e

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.frag

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

653KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FiveM Spoofer.exe

d3d11

d3dcompiler_47

bcrypt

winhttp

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

msvcp140

iphlpapi

wininet

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic