Syntex Spoofer[.]exe

Resubmissions

25/08/2026, 23:41

260825-3pvhzsxtcv6

20/08/2026, 04:01

260820-elf97ael6w8

Sharing

Copy URL Twitter E-mail

General

Target
Syntex Spoofer.exe
Size 146KB
Sample260820-elf97ael6w
SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
MD5 d19a23517f43e45508a441d58f7c63b1
SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
TLSH
T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Syntex Spoofer.exe

.exe 146KB

Syntex Spoofer.exe

IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
MD5 d19a23517f43e45508a441d58f7c63b1
SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
TLSH
T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ed:79:38:04:19:92:73:76:0d:fe:33:cf:c5:a9:d2:df:8b:22:f8:b8:b1:b0:c1:24:33:74:1a:30:18:fc:82:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 12, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

70208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _errno abort __p___wargv _c_exit _register_thread_local_exe_atexit_callback terminate __p___argc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fputwc __p__commode _set_fmode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

toupper _wcsdup wcsncmp wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

setlocale ___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Syntex Spoofer.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic