Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spoofer.exe
Size 375KB
Sample260830-3sft1abl8x
SHA256 4baf84feedf26ac5d28c3d0ad17d1b8dd46d2301adbb898bcb6b0c8ad8cb4d12
MD5 ef3a2694be75f8da903ec11ca6bbadf5
SHA1 38b5e0581787bdf3032faa30c133f7567bfa52e0
SHA512 92825d3bc2558c8350f9f04a4377f99eb2156f7281854a07ee2fdd0a10f12ed48c8216770da794dac1f95d9dc16c43e88e2f81e23b18a2bc05e10509fe9a1838
SSDEEP 6144:CtlTlMFHwgkbBUMQ00sp48oO6nNrLKl6v/Cp:CtBlMFHwgeBdD04F5qNrLX
TLSH
T137844B16EBE409BCF1B7C675C9E18941E7327C4E07B1AADF179088A74E326909E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

File Explorer

Spoofer.exe

.exe 375KB

Spoofer.exe

IMPHASH 2b8031a6bac05a47ebf66956cc466816
SHA256 4baf84feedf26ac5d28c3d0ad17d1b8dd46d2301adbb898bcb6b0c8ad8cb4d12
MD5 ef3a2694be75f8da903ec11ca6bbadf5
SHA1 38b5e0581787bdf3032faa30c133f7567bfa52e0
SHA512 92825d3bc2558c8350f9f04a4377f99eb2156f7281854a07ee2fdd0a10f12ed48c8216770da794dac1f95d9dc16c43e88e2f81e23b18a2bc05e10509fe9a1838
SSDEEP 6144:CtlTlMFHwgkbBUMQ00sp48oO6nNrLKl6v/Cp:CtBlMFHwgeBdD04F5qNrLX
TLSH
T137844B16EBE409BCF1B7C675C9E18941E7327C4E07B1AADF179088A74E326909E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateProcessW CopyFileW WideCharToMultiByte GetTickCount WriteConsoleW SetEndOfFile HeapReAlloc HeapSize GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW CreateThread CloseHandle Process32FirstW Process32NextW GetLastError GetTempPathA Sleep MultiByteToWideChar CreateToolhelp32Snapshot GetFileAttributesW CreateFileW FindClose GetEnvironmentVariableW GetModuleFileNameW DeviceIoControl WriteFile ReadConsoleW GetConsoleMode ReadFile LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileAttributesExW GetExitCodeProcess WaitForSingleObject GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsDebuggerPresent GetCurrentProcess FindFirstFileW CreateDirectoryW IsProcessorFeaturePresent TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

MoveWindow TrackMouseEvent TranslateMessage EndPaint DispatchMessageW ShowWindow RegisterClassExW GetSystemMetrics CreateWindowExW SetWindowRgn GetWindowRect PostMessageW DefWindowProcW GetMessageW ExitWindowsEx PostQuitMessage PtInRect UpdateWindow InvalidateRect GetCursorPos BeginPaint SetCursor

gdi32

CreateRoundRectRgn

advapi32

LookupPrivilegeValueW RegQueryValueExW RegEnumValueW RegOpenKeyExW CheckTokenMembership AdjustTokenPrivileges RegCloseKey AllocateAndInitializeSid RegEnumKeyExW RegDeleteTreeW RegSetValueExW OpenProcessToken FreeSid

shell32

ShellExecuteW

ole32

CoUninitialize CoInitializeEx StringFromGUID2 CoCreateGuid

gdiplus

GdipSetClipRegion GdipDrawPath GdipDrawString GdipCreateFromHDC GdipFillEllipse GdipGetGenericFontFamilySansSerif GdipDrawEllipse GdipCloneBrush GdipMeasureString GdipDeleteRegion GdipAlloc GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipStartPathFigure GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipCreateRegionRect GdipClosePathFigure GdipFillRectangle GdipSetPixelOffsetMode GdipDrawLine GdipFillPath GdipCreateSolidFill GdipFree GdipSetInterpolationMode GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipCreateLineBrushFromRect GdipDeletePath GdipDeleteBrush GdipCreateFontFamilyFromName GdipResetClip GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipSetTextRenderingHint GdipFillRectangleI

shlwapi

PathRemoveFileSpecW

rpcrt4

RpcStringFreeW UuidToStringW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

urlmon

URLDownloadToFileW

Name

.text

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Spoofer.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

shlwapi

rpcrt4

iphlpapi

urlmon

generic