PermSpoofer[.]exe | Triage™

Resubmissions

19/07/2026, 19:39

260719-ydbvaads918

19/07/2026, 19:38

260719-yct98sat4r8

Sharing

Copy URL Twitter E-mail

General

Target
PermSpoofer.exe
Size 670KB
Sample260719-ydbvaads91
SHA256 3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39
MD5 84327300495b887e46d020b7a93a8daf
SHA1 42fb830109493fb948b9c3f3d0ba76d435cec460
SHA512 3ec0b4721caf7c0891b5b6adfc5c1e58c60cbefce0c5e96ee4ceb31d8ac7f940db7c6d58c037cebf644b41d60c12df720637b242f5b6e1d232e8804c7cb5dfbd
SSDEEP 12288:+P5NWyMZdUhjVMILIUJqaJwdEqG7dr9VWqmrDc0K6:wNRMfGuILIWquwdU+NDc
TLSH
T135E48E6AABA505E9C1B7C17D85178613F776B0491320CBDB53E085B92F13AE82F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PermSpoofer.exe

File Explorer

PermSpoofer.exe

.exe 670KB

PermSpoofer.exe

IMPHASH c37eb8eb600ee10d2d0ff9bdebe30846
SHA256 3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39
MD5 84327300495b887e46d020b7a93a8daf
SHA1 42fb830109493fb948b9c3f3d0ba76d435cec460
SHA512 3ec0b4721caf7c0891b5b6adfc5c1e58c60cbefce0c5e96ee4ceb31d8ac7f940db7c6d58c037cebf644b41d60c12df720637b242f5b6e1d232e8804c7cb5dfbd
SSDEEP 12288:+P5NWyMZdUhjVMILIUJqaJwdEqG7dr9VWqmrDc0K6:wNRMfGuILIWquwdU+NDc
TLSH
T135E48E6AABA505E9C1B7C17D85178613F776B0491320CBDB53E085B92F13AE82F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

518892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx WideCharToMultiByte GetLocaleInfoEx GetEnvironmentVariableA GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW WaitForSingleObjectEx MoveFileExA VerSetConditionMask GetTickCount QueryPerformanceCounter VerifyVersionInfoA FreeLibrary GetSystemDirectoryA AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar SleepEx LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA SetLastError QueryFullProcessImageNameW GetModuleHandleW GetModuleHandleA GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW SetConsoleTitleA VirtualProtect CreateThread OutputDebugStringW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError GetProcAddress CloseHandle LoadLibraryA Sleep GetCurrentProcess QueryPerformanceFrequency CreateFileW

user32

ExitWindowsEx MessageBoxA

advapi32

GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptEncrypt CryptImportKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW RegSetValueExW RegCloseKey ConvertSidToStringSidA CopySid SetSecurityInfo CryptDestroyKey IsValidSid InitializeAcl GetLengthSid AddAccessAllowedAce

msvcp140

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setf@ios_base@std@@QEAAHHH@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

normaliz

IdnToAscii

wldap32

ord143 ord217 ord200 ord46 ord30 ord211 ord60 ord45 ord50 ord79 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord301

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateContext CertFreeCertificateChain

ws2_32

WSAStartup WSACleanup accept htonl WSASetLastError ioctlsocket __WSAFDIsSet socket setsockopt select getaddrinfo freeaddrinfo recvfrom sendto ntohs htons gethostname ntohl getsockopt getsockname connect bind WSAGetLastError send recv closesocket WSAIoctl listen getpeername

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __std_terminate strstr __std_exception_copy _CxxThrowException memchr memcmp __current_exception memcpy memmove memset __C_specific_handler strchr strrchr __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn exit _errno strerror __sys_nerr _invalid_parameter_noinfo _resetstkoflw _beginthreadex _getpid abort _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass _dsign

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free _set_new_mode calloc

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod atoi strtoll strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__p__commode _write _close _open _read fgetc _set_fmode __stdio_common_vsscanf _get_stream_buffer_pointers fopen fclose __acrt_iob_func fflush fgetpos __stdio_common_vsprintf ungetc setvbuf _popen _pclose fwrite _fseeki64 fsetpos fread feof fseek ftell fputc _lseeki64 fgets fputs

api-ms-win-crt-filesystem-l1-1-0

_unlink _access _unlock_file _lock_file _fstat64 _stat64

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _time64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-string-l1-1-0

tolower strncmp strspn isupper strncpy strcspn strpbrk strcmp _strdup

api-ms-win-crt-utility-l1-1-0

qsort

shell32

ShellExecuteA