AlexSpoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AlexSpoofer.exe
Size 2.6MB
Sample261002-pchf1asy5j
SHA256 bfe8d6dc490fb0d56cc08330b6201720d562d2a421bf12452108ab850b7b8e4c
MD5 886cfe56417b5960feec00bc99564724
SHA1 0eaad362b32cdb45cb2aadfad2a68aa575e23ae7
SHA512 9e57859179c871906259a6a124f8c5d4daad66d73c2c265a5b2ebd69dd7346d9cb6b93f3c9715a5c6fc7c9d5ad3bd54b3bc0c2db9d14df45ef9ea38ccfef4a45
SSDEEP 49152:A9eo0UhK4lBN0C/VsoQbdfcVd0tzSNfAdc0eg9aADcN0L5rwWc40D9a1CGiicJ9R:CxlBNLV4bFqfAuifcN0NvcuN
TLSH
T198D5D043FBE245ECC753A13886129717D6B5B82117204BDB26E0AB92EF73AD09F75321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AlexSpoofer.exe

File Explorer

AlexSpoofer.exe

.exe 2.6MB

AlexSpoofer.exe

IMPHASH 312416c72bdc6d2fcd732d4a1e56408f
SHA256 bfe8d6dc490fb0d56cc08330b6201720d562d2a421bf12452108ab850b7b8e4c
MD5 886cfe56417b5960feec00bc99564724
SHA1 0eaad362b32cdb45cb2aadfad2a68aa575e23ae7
SHA512 9e57859179c871906259a6a124f8c5d4daad66d73c2c265a5b2ebd69dd7346d9cb6b93f3c9715a5c6fc7c9d5ad3bd54b3bc0c2db9d14df45ef9ea38ccfef4a45
SSDEEP 49152:A9eo0UhK4lBN0C/VsoQbdfcVd0tzSNfAdc0eg9aADcN0L5rwWc40D9a1CGiicJ9R:CxlBNLV4bFqfAuifcN0NvcuN
TLSH
T198D5D043FBE245ECC753A13886129717D6B5B82117204BDB26E0AB92EF73AD09F75321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

802068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kazim\Desktop\Spoofer\Alex Spoofer2\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

FindResourceW GetCurrentProcessId CreateDirectoryA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter GetComputerNameA GetFileSizeEx ReadFile HeapAlloc GetVolumeInformationA CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError LocalFree LockResource GetTempPathA WaitForSingleObject SizeofResource GetModuleHandleW LoadResource FreeLibrary GetProcAddress Sleep LoadLibraryW CreateFileA HeapFree

user32

CreateWindowExW GetKeyState GetMessageExtraInfo PostQuitMessage TranslateMessage ScreenToClient GetCapture ClientToScreen UpdateWindow TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect GetWindowRect MoveWindow GetSystemMetrics SetLayeredWindowAttributes DestroyWindow DefWindowProcW GetWindowLongW SetClipboardData UnregisterClassW GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos RegisterClassExW ShowWindow ReleaseCapture DispatchMessageW IsWindowUnicode SetWindowLongA PeekMessageW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetFolderPathA ShellExecuteExA ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr strstr __std_exception_copy __std_exception_destroy __std_terminate

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _invoke_watson terminate exit

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fputc __p__commode fflush __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fclose __stdio_common_vfprintf __acrt_iob_func _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fseek ftell fgetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

strncpy wcslen strncmp strlen strcmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

sinf acosf ceilf fmodf powf sqrtf ldexp cosf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale