WASP SPOOFER_[unknowncheats[.]me]_[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
WASP SPOOFER_[unknowncheats.me]_.zip
Size 316KB
Sample260930-wqafwaef39
SHA256 b4f1ce7426b49bec488299575d902541427e8f2320c61602b6ca96d2b08453ed
MD5 18bb75922224cbf2950d88cc5126bdde
SHA1 5d2477fd7688eddbf279181b5df3ba8f2c11b62d
SHA512 5a867487cb1bccfca8139d04c8907af57f72aba909fc25b1162f81ca4936b2fb7cbb4b5a249351134353077cc703a0bcb9a349d736b51a9cccce19981ad934a6
SSDEEP 6144:Bkfdgm9AKSFef5LwZKsA6hKI+l05ENNg1jXXqF+UZ0fRi27IneIWy/1EAo:BSo2qKsA5I+OqN21jn2M5j7cPEN
TLSH
T12C642332D48E84AD1737C8753DDE49177EACAE41AD501AAADE640DB382AD2C8FC2154F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WASP SPOOFER.exe

File Explorer

WASP SPOOFER_[unknowncheats.me]_.zip

.zip 316KB
WASP SPOOFER.exe

.exe 678KB

WASP SPOOFER_[unknowncheats.me]_.zip

SHA256 b4f1ce7426b49bec488299575d902541427e8f2320c61602b6ca96d2b08453ed
MD5 18bb75922224cbf2950d88cc5126bdde
SHA1 5d2477fd7688eddbf279181b5df3ba8f2c11b62d
SHA512 5a867487cb1bccfca8139d04c8907af57f72aba909fc25b1162f81ca4936b2fb7cbb4b5a249351134353077cc703a0bcb9a349d736b51a9cccce19981ad934a6
SSDEEP 6144:Bkfdgm9AKSFef5LwZKsA6hKI+l05ENNg1jXXqF+UZ0fRi27IneIWy/1EAo:BSo2qKsA5I+OqN21jn2M5j7cPEN
TLSH
T12C642332D48E84AD1737C8753DDE49177EACAE41AD501AAADE640DB382AD2C8FC2154F
MD5 SHA1 SHA512 SSDEEP TLSH

WASP SPOOFER.exe

IMPHASH 5b3aabbe9b54580fd4142acb9f090538
SHA256 06be962804d3fb024fc63d10ad4dd427024f57d0abf796514a4628f7a1d3e3b1
MD5 f84cd959a1289b0d1a18c4604cccb066
SHA1 ab55987ed3e90801a858ec41e3d4af2328b2f09e
SHA512 419abe904b337eb49f2c79940397e4b4883ec7865a880cc5d75cfd3df1be2ed9d6de6dea042ea94369a3d414e008c7f0cd793f7caa9eb73ddfec79b84aa359c9
SSDEEP 12288:g5hDvArXw0yKVmw7IK+UnJxF5mY1RdYblCVRJgSqKf3J2nBInkjvo:g5hDvArXw0yKVm0IKHnJxiY1R6ugrKfc
TLSH
T1A6E47C4EA2FC01A9E066D13CD1665267B5F23C5747E08FCF63D00C685FA3AD16ABAB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MathisS\Desktop\kdmapper-master\x64\Release\kdmapper_Release.pdb

d3d9

Direct3DCreate9

kernel32

SetConsoleTextAttribute SetConsoleScreenBufferSize GetStdHandle WriteFile SetConsoleWindowInfo CreatePipe WaitForSingleObject Sleep GetTempPathA CopyFileA CreateFileA DeleteFileA FreeConsole GetModuleHandleW GetConsoleWindow CreateProcessA GetTempFileNameA AllocConsole GetTempPathW MultiByteToWideChar GlobalAlloc CloseHandle GetModuleFileNameA WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary VerifyVersionInfoW QueryPerformanceCounter GetModuleHandleA WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetHandleInformation ReadFile GetCurrentProcessId GlobalLock GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl GetProcAddress VirtualFree SleepConditionVariableSRW GlobalFree RtlCaptureContext

user32

GetKeyState GetDC MonitorFromWindow EnumDisplayMonitors ScreenToClient SetWindowTextW WindowFromPoint GetCapture UpdateWindow GetMonitorInfoW ClientToScreen IsChild GetForegroundWindow SetLayeredWindowAttributes SetFocus AdjustWindowRectEx LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetForegroundWindow IsIconic SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData BringWindowToTop PostQuitMessage SetWindowLongW TranslateMessage PeekMessageW DispatchMessageW ShowWindow SetClipboardData GetWindowLongW DefWindowProcW ShowScrollBar GetWindowRect DestroyWindow SetWindowPos CreateWindowExW RegisterClassExW UnregisterClassW GetSystemMetrics

gdi32

GetDeviceCaps

advapi32

RegSetKeyValueW RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ _Thrd_detach ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_do_broadcast_at_thread_exit

ntdll

NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege NtLoadDriver RtlInitUnicodeString

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr memchr memcmp memcpy memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memmove wcsstr __std_exception_destroy __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fflush fseek ftell freopen_s __stdio_common_vsscanf __stdio_common_vsprintf fclose fputc _set_fmode __acrt_iob_func __stdio_common_vswprintf_s _get_stream_buffer_pointers _fseeki64 __p__commode fgetpos fread _wfopen fsetpos ungetc fgetc setvbuf fwrite

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-runtime-l1-1-0

_initterm_e _beginthreadex _get_narrow_winmain_command_line _wassert _exit _set_app_type _c_exit _seh_filter_exe terminate _cexit exit _initterm _register_thread_local_exe_atexit_callback _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_wremove _lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

strncpy_s strncmp strcmp strncpy _stricmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

acosf sinf fmodf cosf ceilf __setusermatherr sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale