spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spoofer.exe
Size 11.5MB
Sample261009-1cs4aacv2p
SHA256 71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a
MD5 0505b681e4d2110dcb009409c27b3e9f
SHA1 511a49274ea9415dfd9758e3e66b0c12f0044d8d
SHA512 4d8d26cc6b1e28507451ffb71d19178c6800941f5460f144a111112640169d28bc84525f39d7e52a3e5b94cbed9d7e7508dfed5d836dd5c6548d36c0c241b0c7
SSDEEP 196608:vDVkyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:p5u+I3qspVAmsu2K
TLSH
T150C68D16E7AA49E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoofer.exe

File Explorer

spoofer.exe

.exe 11.5MB

spoofer.exe

IMPHASH f263203c88e328405168892e2ecda991
SHA256 71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a
MD5 0505b681e4d2110dcb009409c27b3e9f
SHA1 511a49274ea9415dfd9758e3e66b0c12f0044d8d
SHA512 4d8d26cc6b1e28507451ffb71d19178c6800941f5460f144a111112640169d28bc84525f39d7e52a3e5b94cbed9d7e7508dfed5d836dd5c6548d36c0c241b0c7
SSDEEP 196608:vDVkyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:p5u+I3qspVAmsu2K
TLSH
T150C68D16E7AA49E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

534384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Downloads\3LA2 SPOOFER SOURCE LEAK\ZqousSpoofer\bin\Release\x64\ZqousPerm.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

LocalFree VirtualProtect CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW GetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent CreateProcessA GetLastError AreFileApisANSI CreateFile2 FreeLibrary QueryPerformanceFrequency WideCharToMultiByte GetFileAttributesExW FindFirstFileW MultiByteToWideChar CreateDirectoryW GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter QueryPerformanceCounter RemoveDirectoryA GetSystemTimeAsFileTime InitializeSListHead LoadLibraryA GetModuleHandleA GlobalUnlock DeleteFileA WaitForSingleObject GetLogicalDrives GlobalLock GlobalFree GlobalAlloc GetTickCount GetConsoleWindow GetModuleHandleW GetProcessHeap GetCurrentProcessId ExitProcess GetProcAddress HeapAlloc CreateThread CloseHandle Sleep GetCurrentThreadId GetCurrentProcess HeapFree FindClose CreateDirectoryA

user32

GetSystemMetrics PostQuitMessage CreateWindowExW SystemParametersInfoW GetKeyState UpdateWindow LoadCursorW MessageBoxW DestroyWindow GetWindowRect DefWindowProcW ScreenToClient GetCapture ClientToScreen GetWindowLongW MoveWindow TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode MessageBoxA SetClipboardData GetClipboardData RegisterClassExW EmptyClipboard CloseClipboard ShowWindow DispatchMessageW SetWindowLongA OpenClipboard GetCursorPos PeekMessageW SetLayeredWindowAttributes TranslateMessage LoadIconW UnregisterClassW SetCursorPos ReleaseCapture

advapi32

RegOpenKeyExW RegDeleteTreeA RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA CheckTokenMembership FreeSid GetUserNameA AllocateAndInitializeSid

shell32

ShellExecuteA

ole32

CoInitialize CoUninitialize CoCreateInstance

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove __current_exception __C_specific_handler __current_exception_context __std_exception_destroy _CxxThrowException memcmp __std_exception_copy __std_terminate memchr strstr wcsstr memcpy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-convert-l1-1-0

strtol strtod

api-ms-win-crt-runtime-l1-1-0

_errno terminate exit _beginthreadex _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _get_initial_narrow_environment _initterm _initterm_e _c_exit __p___argv __p___argc _exit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-stdio-l1-1-0

fgetpos fwrite _wfopen fgetc fclose fflush __p__commode setvbuf fputc __stdio_common_vsprintf __stdio_common_vsprintf_s ungetc _popen fgets _pclose fsetpos _fseeki64 _get_stream_buffer_pointers ftell __acrt_iob_func fseek __stdio_common_vsscanf __stdio_common_vfprintf _set_fmode fread

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file

api-ms-win-crt-string-l1-1-0

tolower _wcsicmp islower isdigit isalnum isupper strncmp strlen strcmp strncpy wcslen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf powf fmodf cosf ceilf acosf sqrtf