hwidspoof_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hwidspoof_x64.exe
Size 18.4MB
Sample260718-ntfhasdv4z
SHA256 7116093a0106ac36c57f6371655e81cbe9e171f04c3901115e88252c4ff43a4b
MD5 8b74c92252f2a83112147c9ee0c9d7e0
SHA1 6d8f3d0047942026a8c7e27529ffb36fe5cc59ee
SHA512 107235e5330cadbd1b9c57573a81daa9c6e88201dba69d3bc371184e28415cebbe001f94ee9477c1fe0a35527ee8c610510d1ee42695b7d0ca278db11a49d810
SSDEEP 196608:Iqd6RKi5i1x3r2ftWhpJz1AK/wBBuuoj4GuKww81ZmZ9KBceIidrHphvpjGo:45KJQWhzz1AKNurG2qZ9KB2OrpP
TLSH
T14717CE03F16659FDE56AC07083467937FA72BC4D42216AEF5FD80A307F65F906628B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hwidspoof_x64.exe

File Explorer

hwidspoof_x64.exe

.exe 18.4MB

hwidspoof_x64.exe

IMPHASH f06fee289582098e796cf7a7a4fd9737
SHA256 7116093a0106ac36c57f6371655e81cbe9e171f04c3901115e88252c4ff43a4b
MD5 8b74c92252f2a83112147c9ee0c9d7e0
SHA1 6d8f3d0047942026a8c7e27529ffb36fe5cc59ee
SHA512 107235e5330cadbd1b9c57573a81daa9c6e88201dba69d3bc371184e28415cebbe001f94ee9477c1fe0a35527ee8c610510d1ee42695b7d0ca278db11a49d810
SSDEEP 196608:Iqd6RKi5i1x3r2ftWhpJz1AK/wBBuuoj4GuKww81ZmZ9KBceIidrHphvpjGo:45KJQWhzz1AKNurG2qZ9KB2OrpP
TLSH
T14717CE03F16659FDE56AC07083467937FA72BC4D42216AEF5FD80A307F65F906628B0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6790912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hwspoof.pdb

kernel32

GlobalFree GetSystemTimeAsFileTime CreateThread GetStartupInfoW CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WriteConsoleW WaitForSingleObject GetConsoleOutputCP GetFullPathNameW GetConsoleMode CreateEventA GetStdHandle GetFileInformationByHandleEx FreeLibrary TlsAlloc GetFileInformationByHandle CreateIoCompletionPort GetProcAddress SetThreadErrorMode LoadLibraryExW GetModuleHandleA PostQueuedCompletionStatus GlobalMemoryStatusEx Sleep GetFinalPathNameByHandleW GetQueuedCompletionStatusEx DuplicateHandle GetCurrentProcess SetFileInformationByHandle LocalFree IsProcessorFeaturePresent ExitProcess FindNextFileW SetFilePointerEx FindClose FindFirstFileExW GetCurrentThread SetThreadStackGuarantee GetSystemTimePreciseAsFileTime TlsGetValue TlsSetValue TlsFree WriteFile TerminateProcess SetStdHandle GetFileType FlushFileBuffers GetProcessIoCounters GetModuleFileNameW SetLastError GetModuleHandleExW GetSystemTimes OpenProcess ReleaseMutex SwitchToThread CloseHandle GetProcessTimes GetLastError GetSystemInfo GetCurrentThreadId CreateFileW GetTempPathW GetTimeZoneInformationForYear GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage LoadLibraryExA GetCommandLineW GetCommandLineA GlobalAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GlobalUnlock LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer GlobalSize GlobalLock RemoveVectoredExceptionHandler K32GetPerformanceInfo SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead CompareStringW LCMapStringW VirtualQueryEx ReadProcessMemory QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleW HeapAlloc GetEnvironmentVariableW lstrlenW LoadLibraryA GetCurrentDirectoryW MultiByteToWideChar VirtualProtect MapViewOfFile CreateFileMappingW GetUserPreferredUILanguages UnmapViewOfFile WideCharToMultiByte FormatMessageW AddVectoredExceptionHandler IsDebuggerPresent HeapReAlloc HeapFree GetProcessHeap HeapSize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

CreateIcon GetClipCursor ClipCursor GetWindowRect RegisterWindowMessageA ShowCursor SystemParametersInfoA GetWindowLongPtrW GetWindowLongW SetWindowLongW DestroyIcon DefWindowProcA FlashWindowEx RegisterClassExA AdjustWindowRectEx ShowWindow ReleaseDC InvalidateRgn SetWindowPlacement ChangeDisplaySettingsExW SetWindowPos GetCursorPos MonitorFromRect GetWindowPlacement ScreenToClient GetMenu SetCursor LoadCursorW SetWindowTextW PostMessageW ValidateRect IsProcessDPIAware SetWindowDisplayAffinity GetDC GetSystemMetrics DefWindowProcW DispatchMessageW TranslateMessage KillTimer SetTimer GetMessageW PeekMessageW DestroyWindow RedrawWindow GetMonitorInfoW MonitorFromPoint SetWindowLongPtrW CreateWindowExW RegisterClassExW SendMessageW MonitorFromWindow TrackPopupMenu SetMenuDefaultItem EnableMenuItem GetSystemMenu ClientToScreen SetForegroundWindow GetForegroundWindow IsIconic GetClientRect IsWindowVisible CreateWindowExA RegisterRawInputDevices GetKeyState GetTouchInputInfo TrackMouseEvent RegisterTouchWindow ReleaseCapture GetKeyboardState GetAsyncKeyState EmptyClipboard SetClipboardData GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx CloseTouchInputHandle SetCapture GetClipboardData SendInput GetActiveWindow CloseClipboard OpenClipboard MapVirtualKeyW GetRawInputData

gdi32

DeleteObject CreateCompatibleDC CreateDIBSection BitBlt GetDeviceCaps CreateRectRgn DeleteDC SelectObject SetPixelFormat DescribePixelFormat ChoosePixelFormat GetPixelFormat SwapBuffers

shell32

CommandLineToArgvW ShellExecuteW DragFinish DragQueryFileW

ntdll

NtQueryInformationProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtReadFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlUnwindEx RtlPcToFileHeader NtWriteFile NtQuerySystemInformation

advapi32

IsValidSid OpenProcessToken GetLengthSid ImpersonateAnonymousToken RevertToSelf CopySid GetTokenInformation SystemFunction036

oleaut32

GetErrorInfo SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

pdh

PdhOpenQueryA PdhCollectQueryData PdhRemoveCounter PdhGetFormattedCounterValue PdhCloseQuery PdhAddEnglishCounterW

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmAssociateContextEx

ole32

RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize OleInitialize

opengl32

wglDeleteContext wglCreateContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

d3dcompiler_47

D3DCompile

uxtheme

SetWindowTheme

Name

.text

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hwidspoof_x64.exe

kernel32

api-ms-win-core-synch-l1-2-0

user32

gdi32

shell32

ntdll

advapi32

oleaut32

bcryptprimitives

bcrypt

pdh

dwmapi

imm32

ole32

opengl32

psapi

powrprof

d3dcompiler_47

uxtheme

generic