Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spoofer.exe
Size 2.7MB
Sample261002-rpr73szekd
SHA256 423b62300dd652d47570df7b7a9c285c360ac419c2a8394743fc21c6f3008de2
MD5 d6853fa142d25dea58986667d6d0597d
SHA1 f80703c3f11eb833d823c79942c23f720bea74d1
SHA512 a665572fecd5f9f73aaa28cf4a0e909f3bcc755d741e62c44566605f5570b038604ed8b8756d870f3d56a1435a2cc956a246037840df2a3fb35af7bc936c21d4
SSDEEP 49152:Q8q3njzIjDlnygMqfWjOFlW6cbODw7gOuUEMKn7/6n4OdFj:k3jzNklW6cbODw7gOuUvN4Ov
TLSH
T16ED5BE07E36442ECC96B9538C6A68B47F3B5B8442311D7CF22E46B596F536E01F7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

File Explorer

Spoofer.exe

.exe 2.7MB

Spoofer.exe

IMPHASH eed2de612ae14f25065036c3c8b3fbf0
SHA256 423b62300dd652d47570df7b7a9c285c360ac419c2a8394743fc21c6f3008de2
MD5 d6853fa142d25dea58986667d6d0597d
SHA1 f80703c3f11eb833d823c79942c23f720bea74d1
SHA512 a665572fecd5f9f73aaa28cf4a0e909f3bcc755d741e62c44566605f5570b038604ed8b8756d870f3d56a1435a2cc956a246037840df2a3fb35af7bc936c21d4
SSDEEP 49152:Q8q3njzIjDlnygMqfWjOFlW6cbODw7gOuUEMKn7/6n4OdFj:k3jzNklW6cbODw7gOuUvN4Ov
TLSH
T16ED5BE07E36442ECC96B9538C6A68B47F3B5B8442311D7CF22E46B596F536E01F7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1395224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hash\Desktop\SinaPerm\Verse-ui_-master V2\x64\Release\Verse ui.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind AreFileApisANSI RtlLookupFunctionEntry RtlCaptureContext GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW VerifyVersionInfoW GetCurrentProcessId WaitForMultipleObjects GetFileInformationByHandleEx CheckRemoteDebuggerPresent IsDebuggerPresent ExitProcess Sleep GetModuleHandleW CreateProcessW PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW GetTickCount GetSystemInfo SleepEx GetSystemDirectoryW LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameW CreateFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileW GetLastError AddVectoredExceptionHandler CloseHandle WaitForSingleObject CreatePipe GetCurrentProcess ReadFile LoadLibraryW QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency WakeAllConditionVariable LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree HeapDestroy HeapSize InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect GlobalAlloc MultiByteToWideChar CreateFileMappingW GetModuleFileNameA

user32

SetClipboardData GetWindowLongW DefWindowProcW DestroyWindow MessageBoxW CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetWindowRect MoveWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData

advapi32

CopySid SetSecurityInfo RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid ConvertSidToStringSidA AddAccessAllowedAce SystemFunction036 CryptDestroyKey CheckTokenMembership FreeSid OpenProcessToken AllocateAndInitializeSid CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptImportKey CryptEncrypt

shell32

ShellExecuteA ShellExecuteW

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?good@ios_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Xlength_error@std@@YAXPEBD@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_counter ?_Random_device@std@@YAIXZ _Query_perf_frequency ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

crypt32

CryptDecodeObjectEx CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW

ws2_32

connect bind WSACleanup WSAStartup getpeername inet_ntop WSASetLastError ntohs getsockname inet_pton htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent recv setsockopt WSAEventSelect WSAEnumNetworkEvents WSACloseEvent send getsockopt sendto socket WSAIoctl gethostname ioctlsocket WSACreateEvent recvfrom __WSAFDIsSet freeaddrinfo getaddrinfo listen htonl accept select

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset memchr memcmp _CxxThrowException strchr wcschr __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-stdio-l1-1-0

__p__commode fread _lseeki64 __stdio_common_vsscanf _wfopen fwrite ftell _wopen __stdio_common_vfprintf fseek feof fputs _set_fmode _read _write _fileno fclose _close fflush __acrt_iob_func ungetc setvbuf _popen _pclose _fseeki64 fsetpos fputc fgets fgetpos fgetc _get_stream_buffer_pointers __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-string-l1-1-0

strncpy _wcsdup strcspn tolower wcspbrk strcmp strspn _strdup strncmp wcsncmp strpbrk wcsncpy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free realloc calloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn exit system _errno __sys_errlist __sys_nerr abort _invalid_parameter_noinfo _resetstkoflw _beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtoll atoi wcstombs strtoul strtod

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _localtime64_s _time64 _localtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlink remove _wstat64 _fstat64 _unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_dsign _dclass _fdopen sqrtf acosf ceilf cosf fmodf pow powf sinf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv