FiveM Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FiveM Spoofer.exe
Size 3.6MB
Sample260715-lrcbracv4x
SHA256 3d7bcc3b7cb1faf1354c0c5e927c1db64e2e34ebc226c30ac10e34babafd6a8f
MD5 f9e3e9031691fa01aae08f8178b82460
SHA1 54b4bccf5b5448cbd5a6128eb99475060a630e56
SHA512 654774a3adac2b83ee71985350d11fa8fa20e8684cb9b5446e2873cc51667dce29d9a660c439e2dc01e1ea3570113761b49d3d981efb7545e4f19a150f031144
SSDEEP 49152:/opD4YS7JslWdyIaZUngVga0lOgdJWihLNKVG+FzovGYkuG:/oXwDLN0ovGYku
TLSH
T11A069D2433AB2810C972EC3898AEE7EE82D2AD604B57C7CF654561AC1A338F55777D43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FiveM Spoofer.exe

File Explorer

FiveM Spoofer.exe

.exe 3.6MB

FiveM Spoofer.exe

IMPHASH 238c7f7fb0ead7658e8a9b43cd533d08
SHA256 3d7bcc3b7cb1faf1354c0c5e927c1db64e2e34ebc226c30ac10e34babafd6a8f
MD5 f9e3e9031691fa01aae08f8178b82460
SHA1 54b4bccf5b5448cbd5a6128eb99475060a630e56
SHA512 654774a3adac2b83ee71985350d11fa8fa20e8684cb9b5446e2873cc51667dce29d9a660c439e2dc01e1ea3570113761b49d3d981efb7545e4f19a150f031144
SSDEEP 49152:/opD4YS7JslWdyIaZUngVga0lOgdJWihLNKVG+FzovGYkuG:/oXwDLN0ovGYku
TLSH
T11A069D2433AB2810C972EC3898AEE7EE82D2AD604B57C7CF654561AC1A338F55777D43
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8061

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\FiveM Spoofer\x64\Release\FiveM Spoofer.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

bcrypt

BCryptCreateHash BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptFinishHash BCryptDestroyKey BCryptImportKey BCryptDecrypt BCryptDestroyHash BCryptHash

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpConnect WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReadData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar GetLastError GetCommandLineW DeleteFileA GetTempPathA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess ExitProcess GetExitCodeProcess CreateProcessA GlobalMemoryStatusEx GetSystemInfo GetTickCount64 VirtualProtect GetModuleFileNameA GetModuleHandleW LoadResource LockResource SizeofResource GlobalSize FindResourceA CopyFileA GetComputerNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushInstructionCache VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA LocalFree WideCharToMultiByte

user32

GetClipboardData OpenClipboard wsprintfW TranslateMessage DispatchMessageW SetClipboardData CloseClipboard EmptyClipboard PeekMessageW SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout MessageBoxA AdjustWindowRect ReleaseDC GetDC UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW

gdi32

GetDeviceCaps CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateRectRgn BitBlt

advapi32

GetUserNameA

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal GetHGlobalFromStream CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

CreateErrorInfo SysAllocString SysFreeString GetErrorInfo VariantInit VariantChangeType SetErrorInfo VariantClear

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setf@ios_base@std@@QEAAHHH@Z _Xtime_get_ticks ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Thrd_detach _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Throw_Cpp_error@std@@YAXH@Z

iphlpapi

GetAdaptersInfo

dnsapi

DnsQuery_W DnsFree

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

vcruntime140

strstr __std_type_info_destroy_list __current_exception_context __current_exception _purecall __C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy wcsstr memcmp strchr memset memmove memcpy memchr __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

ungetc __stdio_common_vsprintf_s setvbuf _fseeki64 fsetpos fputc fgetpos _get_stream_buffer_pointers __p__commode _set_fmode __acrt_iob_func fclose fopen_s _wfopen __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fwrite ftell fseek fread fflush fgetc

api-ms-win-crt-heap-l1-1-0

realloc calloc _set_new_mode _callnewh malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceilf log logf sinf powf pow acosf atan2f cosf fmodf sqrtf floorf __setusermatherr _dclass _dsign

api-ms-win-crt-string-l1-1-0

tolower isalnum strlen strncpy strcmp strncmp wcslen toupper

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll atof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _execute_onexit_table _crt_atexit _set_app_type _cexit _c_exit __p___argv _get_initial_narrow_environment _seh_filter_exe _initterm _initterm_e exit _crt_at_quick_exit _errno _exit __p___argc _beginthreadex terminate

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.frag

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

653KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FiveM Spoofer.exe

d3d11

d3dcompiler_47

bcrypt

winhttp

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

msvcp140

iphlpapi

dnsapi

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic