Ls Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Ls Spoofer.exe
Size 433KB
Sample260802-wd6csaybjf
SHA256 7b879740328b02e094717660497b1b4f1144b139a2f7ddb63b36f9778a1fad55
MD5 d67e69468273cc920dbe9d3ae7a765a9
SHA1 2c0a3a7e3493ad3102ca1566c70345d518ceb44f
SHA512 bc33ef5d9fa513e401d867eed93bb90f387ddec5376fa24cff567554b099f24f892130dc08eeb91cdcc570ae711b56efac80133a86d469946382c9c9a59549ec
SSDEEP 6144:KMzWHb8R1F52ZkhZ4HpQurk/hdBtnppE4+WvcQoneQcjnUSilKz:KMRL52Sf42urkjnHcOfon8wQ
TLSH
T12F948E5AE56410ADD17B9478D1676A0BEB323C8907606BCF33D409A62FA27E46F7F301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ls Spoofer.exe

File Explorer

Ls Spoofer.exe

.exe 433KB

Ls Spoofer.exe

IMPHASH 2f19e74c81595d6aa0d6e88202a5756d
SHA256 7b879740328b02e094717660497b1b4f1144b139a2f7ddb63b36f9778a1fad55
MD5 d67e69468273cc920dbe9d3ae7a765a9
SHA1 2c0a3a7e3493ad3102ca1566c70345d518ceb44f
SHA512 bc33ef5d9fa513e401d867eed93bb90f387ddec5376fa24cff567554b099f24f892130dc08eeb91cdcc570ae711b56efac80133a86d469946382c9c9a59549ec
SSDEEP 6144:KMzWHb8R1F52ZkhZ4HpQurk/hdBtnppE4+WvcQoneQcjnUSilKz:KMRL52Sf42urkjnHcOfon8wQ
TLSH
T12F948E5AE56410ADD17B9478D1676A0BEB323C8907606BCF33D409A62FA27E46F7F301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

57776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\LineFlexx\Desktop\Ban Checker\x64\Release\Ban Checker.pdb

kernel32

CreateToolhelp32Snapshot GetTempPathA Process32NextW Process32FirstW CloseHandle SetFileAttributesA OpenProcess VirtualAllocEx SetConsoleCP CreateRemoteThread SetConsoleOutputCP CreateDirectoryA VirtualFreeEx GetModuleHandleA WaitForSingleObject GetEnvironmentVariableA GetStdHandle SetConsoleTitleA SetConsoleTextAttribute WriteProcessMemory GetProcAddress GetModuleFileNameA InitializeSListHead GetSystemTimeAsFileTime Sleep GetCurrentThreadId SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId

advapi32

RegGetValueA AllocateAndInitializeSid RegSetValueExA FreeSid CheckTokenMembership RegOpenKeyExA RegEnumKeyExA RegCloseKey

shell32

ShellExecuteExA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Random_device@std@@YAIXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

wininet

HttpOpenRequestA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetSetOptionW InternetReadFile InternetQueryOptionW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception __current_exception_context __C_specific_handler memmove __std_exception_destroy __std_terminate memcpy _CxxThrowException memcmp __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fgetpos fflush __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fclose __stdio_common_vsprintf fwrite fgetc fputc

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _crt_atexit _get_initial_narrow_environment _configure_narrow_argv exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _initialize_onexit_table _initterm_e _initialize_narrow_environment _initterm

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s isalnum strlen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale