JohnFrez3Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
JohnFrez3Spoofer.exe
Size 1006KB
Sample261014-wf87fshb75
SHA256 553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e
MD5 097bf42a736e1cf70b8b7e966faa9393
SHA1 573f5146baf5ab12e271658d5bc50780f517ca06
SHA512 1a5ad0116b3595bd726c23241feb75a8fb8fc7ea903ca7a9d082444a91bdd695fa8a39593258ccabec2092a1eb1d45b87acd1bf52c9da2775184cee28c79acb2
SSDEEP 24576:qXyyBU4q1zSq2kYr6mNIWHil/a8BCjheH+O6z8x:sn24K2q2kYrWta8CE6z8x
TLSH
T167251212E37620EDF0B2D57989A62742F23378154B309BDF8750866A5F237E4AC39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JohnFrez3Spoofer.exe

File Explorer

JohnFrez3Spoofer.exe

.exe 1006KB

JohnFrez3Spoofer.exe

IMPHASH 210042d1347887bc3ce7af80d3c8cdba
SHA256 553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e
MD5 097bf42a736e1cf70b8b7e966faa9393
SHA1 573f5146baf5ab12e271658d5bc50780f517ca06
SHA512 1a5ad0116b3595bd726c23241feb75a8fb8fc7ea903ca7a9d082444a91bdd695fa8a39593258ccabec2092a1eb1d45b87acd1bf52c9da2775184cee28c79acb2
SSDEEP 24576:qXyyBU4q1zSq2kYr6mNIWHil/a8BCjheH+O6z8x:sn24K2q2kYrWta8CE6z8x
TLSH
T167251212E37620EDF0B2D57989A62742F23378154B309BDF8750866A5F237E4AC39F21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage LoadCursorW FrameRect FillRect WindowFromPoint GetCursorPos MessageBoxW GetWindowRect GetClientRect GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW IsWindowEnabled EnableWindow KillTimer SetTimer GetDlgCtrlID SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW GetMessageW

gdi32

GetStockObject CreateSolidBrush Ellipse MoveToEx SetTextColor SetPixel SetBkMode SetBkColor SelectObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen DeleteObject DeleteDC LineTo

advapi32

RegCreateKeyExW CheckTokenMembership FreeSid StartServiceW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey AllocateAndInitializeSid

iphlpapi

GetAdaptersAddresses

shell32

ShellExecuteW

kernel32

GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW Sleep GetCommandLineA GetCPInfo GetLastError ReleaseMutex CreateMutexW GetLocalTime GetTickCount GetModuleFileNameW CreateFileW DeleteFileW ReadFile WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DeviceIoControl WaitForSingleObject GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateThread CreateProcessW GetTickCount64 GetSystemDirectoryW GetSystemFirmwareTable FreeLibrary GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW MoveFileExW MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetOEMCP RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

841KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JohnFrez3Spoofer.exe

user32

gdi32

advapi32

iphlpapi

shell32

kernel32

generic