FiveMSpoofer.zip
- SHA256 6f175412a25e9819eb75fb2d718858d3c4c5c7e093525b60a334a58bae48eae7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CFXBypass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
CFXBypass.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target FiveMSpoofer.zip
- Size 4.4MB
- Sample261009-pg85hsxs5p
- SHA256 6f175412a25e9819eb75fb2d718858d3c4c5c7e093525b60a334a58bae48eae7
- MD5 3595a43418463e5570f675fb47452362
- SHA1 0dd27fd73ea8ca9bdfabbe0e3098c0f8f382c212
- SHA512 320667fa738ef5ddbea8389b46e7386cce511077da5a17cd69bf01fb39f94d6abf445d6a8432bfe0ede098ad1f36a853c07bc33d533ea90d1cb04d044e3027c3
- SSDEEP 98304:m87eUXSUaqguwwys6BCEsU0OIZBiduze4TembDDDe8GJ:m+XSUHrwzs2IZBTztTemb6h
- TLSH T16E26330A9CC832C1A1EFC5E562CE4F585C357CA24EB2F65007D997FE3A0C968E5EB512
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CFXBypass.exe
File Explorer
-
FiveMSpoofer.zip.zip 4.4MB
-
CFXBypass.exe.exe 8.0MB
-
CFXBypass.sln1KB
-
main/common.hpp278B
-
main/core/network.cpp2KB
-
main/core/network.hpp264B
-
main/core/trace.cpp2KB
-
main/core/trace.hpp395B
-
main/main.cpp2KB
-
main/smallcock.vcxproj.xml 7KB
-
main/smallcock.vcxproj.filters1KB
CFXBypass.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a
- MD5 53648dee77c997e3665a8c3add00eeaa
- SHA1 dfeedc4eae6c517ef1286bd041cc36de8a608f46
- SHA512 598afff16262ee75f9866a62a124407c6ef5dff8c577371ea79ea8817805be998ba6d0553497400312c1cf5c0106772696727f312bd55ac99a8c23dd6e138f65
- SSDEEP 98304:V3T2h9PPeJzgg3ty1qrMGUjEBoSMeduU8gsHZVY/YK2:VjigJMg3E1qwQFM/U8gsHCYX
- TLSH T1FC867C43EC9159E9C1A9A33089A79253BB71BC481B3223D72B90F7392F76BD06E75350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
506368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
300KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
479KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
775KB
Virtual Size
775KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/95
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
409KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
CFXBypass.sln
- SHA256 643897a48a22c67db958b9fe4bc24f1fb1df45da7772714dbe74c27c39c50528
- MD5 e1690af0ae70b5a72be890b21cd494fe
- SHA1 426cc25d2c8844cf4a9036c24fe6860dc3309bcb
- SHA512 57decccfe5f8ab15296942615de515a5c04eb1d78c6a964289f2d6ea6f13f658080c7bc79b607ea6b330a29ec5d84938d25acb208cdd9253718630a05aa338ac
- TLSH T1BC314C7C703E6AD499CA12EFD9780C8D2F364644C1DD393D64C248ECA7A3A10427BA9B
- MD5 SHA1 SHA512 TLSH
main/common.hpp
- SHA256 9d3eb94167531ee3bb22d071e9de44b508cd6c6217c7cdacd05e3d4aae0733e0
- MD5 befe84701670f471e5c0edcdd261dfe3
- SHA1 d01a35918f005d8eb5a13e77e6de90074eb34f70
- SHA512 f211cba2a917384c554501a633b55b018f1a2c8bd867fc982f6e914c7582925bcf8b1ec3769b263c01e426047677914c0981a4f03d7f586b9c4d6d94454d13ab
- TLSH T182D00974E43E5A12C61354F77287D121125C3A415BC5B2B1749670E7F4019CD37AF7E9
- MD5 SHA1 SHA512 TLSH
main/core/network.cpp
- SHA256 bfdb4096a971066037a9ef9d27608ab0853f78dd8a5f045d1d4b8693f5e74c26
- MD5 1b9540e37b72e4c23cf32b95c80cc527
- SHA1 687e05347bf9828d0c690e1dcf3cb730809fefc4
- SHA512 17ef08e1613b5e2b7fef32b60997ab8df8c94d6602d278f59819cd1a9b54c9cf050a531f432251c628bd96d3a3b5d414e2cdc4be4c5ddfed9f3ea72671e91dfd
- TLSH T111517B07E9BE6BA82AD5A120FF7462035EC4778B133603F16976C0548F1C07815E5ABF
- MD5 SHA1 SHA512 TLSH
main/core/network.hpp
- SHA256 a7e593427b262004934a51c8b429379488500672f418f19ee47343a6359ccd9b
- MD5 592a892a211e4aeee75235c8d303ede7
- SHA1 e6f117ceaa91878dfc50f17f79280268d31b50e8
- SHA512 23e8e2d2616cc9fbdff1dc9474fcc6b6df7f892bc41736f619132b1ffa36ae301583a49c7925cf9df6c7a6e89af567f969618d3499e4f393431876e429b79241
- TLSH T1DED05B51E4F67D8155025539D2362A074C593400775B1FF9F1B3F1F19A541A431691EF
- MD5 SHA1 SHA512 TLSH
main/core/trace.cpp
- SHA256 d329e3c078f7e9a71baea533ca4bdd042f4dbb0fa1fee39f8f8ea89b4c303068
- MD5 ed7173c6379680d523130815fb150c91
- SHA1 d67d1d508ad6c75ffb86164116ed05ad126aea5b
- SHA512 ee31bef524fe8e3fa79285185ecb9f60925515dd2594dba9aa0a87f577d152dd3e13e36bd5bdf1cc45d05f78aea4ca626dad976c197a1d615847500b155e6ecb
- TLSH T1FD514317B4B7FF197AA176C652B40A077C5070A697F703F6E4C71048A23B92E31B927A
- MD5 SHA1 SHA512 TLSH
main/core/trace.hpp
- SHA256 07ba8ae0b70faedc8694325b7d0b36af85bf58bafd01765817f8493e4f67bee4
- MD5 0aaa599caadbccfe4143b3bd860d28d8
- SHA1 959a74063510b3bbc6818d94b3c88b308eeab01f
- SHA512 5eee56ecb6ee5cba77c91d238a3042e44e0c116722c84be83940016a8b9d280e6dae8169a6fe7713411cc5d922b04be8b0b77fba5eeac8c65d79b242fbf7f086
- TLSH T16FE0921324F6FF150D229B69A1FA1A43459031D1275A8BE1E7E360F11835555BCB5068
- MD5 SHA1 SHA512 TLSH
main/main.cpp
- SHA256 cc2ea3b0d0c5c33c65f8df7fd7621a8b6420dfa9be652e057333b933bb7a0529
- MD5 bff5208621ba9a005c61480b2adb1e6d
- SHA1 e27cb3f82430352ced9539289823a277da0f7e85
- SHA512 a3603bad84187e947245896e8d1731f09d407268beba1ccdb0ac5b8d23ba064ed72d211b6252e05eeb5647cecd1ae7d28452753fcd6b5530de09ce868829d18c
- TLSH T1565148837BFD6E0C08B0454A123410CADC5DD4218B3287E97AAF7279EB3EF534666532
- MD5 SHA1 SHA512 TLSH
main/smallcock.vcxproj
- SHA256 242a6cb44b38eda019b9c12a5a4bbd06f0c054ce22cceebe540c4a96a187ee52
- MD5 42a2db66da5bb6f1596fbafc30e7cd22
- SHA1 80456f086175abe5ae470c6a4a7fbbff6d2c8e8b
- SHA512 c44f983dd36461269979274c6746f0cbe7d82f601bb03ae678d84543aa41955c4773f4b0eb46d226934b20c236981079d29af783f9abe32a8015f7fae5100026
- SSDEEP 192:e/zclKls4FQn/YPce/JPct/gPcL/mPcsFi:G43/cD/dg/k2/mLi
- TLSH T1B2F1EAA4E4E02E5A81B7422BE1D74981EE71D3830D5A4C6CF69EE35B4F775483213B32
- MD5 SHA1 SHA512 SSDEEP TLSH
main/smallcock.vcxproj.filters
- SHA256 706b0676495998aebf01d00566cd165415f513460db1d5cdd418998f346214e0
- MD5 4b4b8a2cb4b2ad97d81ae6f2b6fc9b17
- SHA1 d3d9b2145150d780fbc4a2b6719a076c7258707c
- SHA512 9c78d659cec38c00f513293b0d7b0348fa3dd450aa7bed7923cf781840fe355a0b1516fcb5c32a514ba55e08a5b58cc76ae20842dbadd7953d96475a5104a943
- TLSH T123312821C9DC3A881133092BF680DE05EE7972F3A1C1154476ADE187AFB3648D277628
- MD5 SHA1 SHA512 TLSH