Temp Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Temp Spoofer.exe
Size 5.4MB
Sample260805-29sdpatte1
SHA256 f5b9806b73383596089332bc3bc34af8385b7cab0818e3dd5d64f0d90bab3272
MD5 15cf0fe9d22747a3b55572b309ac6168
SHA1 79696352e5e9ec3a7c684f2d1972355ae5a92fae
SHA512 e249ee77a5f6b1425d9b1436a08d3b463c1e63adc01779a03bafaad9fcd800c20dc211856686cb2a3ce3908b9837eb3e2e1777ec56422924cc5a579c40342b04
SSDEEP 49152:KWkqv1TmhXnspnsuxK0Ervgir1B4xpTX3eYdr1TYxYFUfT/7z+zdzuaU48rJcXrm:KW1EhXaxqbX4WH/7CIeBI
TLSH
T18C469E42736400B0DAB361BCC65B650BEA75B44B33E06BD712E89B19DF139E4963E3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Temp Spoofer.exe

File Explorer

Temp Spoofer.exe

.exe 5.4MB

Temp Spoofer.exe

IMPHASH 4f19b8b7522b5d03f4fba57ca7d5fe09
SHA256 f5b9806b73383596089332bc3bc34af8385b7cab0818e3dd5d64f0d90bab3272
MD5 15cf0fe9d22747a3b55572b309ac6168
SHA1 79696352e5e9ec3a7c684f2d1972355ae5a92fae
SHA512 e249ee77a5f6b1425d9b1436a08d3b463c1e63adc01779a03bafaad9fcd800c20dc211856686cb2a3ce3908b9837eb3e2e1777ec56422924cc5a579c40342b04
SSDEEP 49152:KWkqv1TmhXnspnsuxK0Ervgir1B4xpTX3eYdr1TYxYFUfT/7z+zdzuaU48rJcXrm:KW1EhXaxqbX4WH/7CIeBI
TLSH
T18C469E42736400B0DAB361BCC65B650BEA75B44B33E06BD712E89B19DF139E4963E3E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

659688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte CreateDirectoryA DeleteFileW CloseHandle GetLastError WaitForSingleObject Sleep GetConsoleWindow CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree LoadLibraryA MapViewOfFile UnmapViewOfFile GetLocaleInfoA GetProcAddress LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA MultiByteToWideChar FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter

user32

GetMessageExtraInfo GetCapture TrackMouseEvent ReleaseCapture IsWindowUnicode GetForegroundWindow GetKeyState GetKeyboardLayout SetCapture GetWindowRect UpdateWindow SetWindowPos ShowWindow DestroyWindow UnregisterClassA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage MessageBoxA PostMessageA CreateWindowExA RegisterClassA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect OpenClipboard

shell32

ShellExecuteExW SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

iphlpapi

GetAdaptersInfo

vcruntime140

__std_exception_destroy _CxxThrowException strrchr longjmp __std_exception_copy __current_exception __current_exception_context __intrinsic_setjmp __C_specific_handler memcpy strstr memmove memcmp memchr __std_terminate memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

toupper strlen strcpy_s wcslen strcmp strncmp strncpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s ungetc setvbuf _fseeki64 fsetpos fputc fgetpos fgetc _set_fmode fwrite __acrt_iob_func fseek fread __p__commode ftell fflush fclose _wfopen __stdio_common_vfprintf __stdio_common_vsscanf _get_stream_buffer_pointers __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceilf acosf sinf cosf fmodf sqrtf fabs __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _get_narrow_winmain_command_line system _set_app_type _c_exit _invalid_parameter_noinfo_noreturn _seh_filter_exe terminate _beginthreadex _register_thread_local_exe_atexit_callback _cexit _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale