spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spoofer.exe
Size 486KB
Sample261016-12tfca11bt
SHA256 b30bb2ac9fec52b5980687cbabd88f2810a9ace78865f649aefcdb590a08b7c9
MD5 b66aaeb04d521b593e2005610172c65d
SHA1 a7dc733ca634d427a00670f115833f7097822a47
SHA512 6191eb53590430de2f6b258c9fbffc58ba7b2bd0d25ea51530cf3b532184efc1643e3a46940288bc87a98336a0a5454809c100bd50fc18083af7fb87b7c617ab
SSDEEP 6144:iZE1ilcbpf0OEDnbOUr+05F09HNifiNZuvcLXTvGjvYg2PMlNcY:i2wAs1+0g90ivuC78Y
TLSH
T14AB46CA5A6A801FCE177D1B8CA174903F671784A0331AEDF03D099B21F176E59E7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoofer.exe

File Explorer

spoofer.exe

.exe 486KB

spoofer.exe

IMPHASH a2e10bdf48bdbc801dd5f18f981b173f
SHA256 b30bb2ac9fec52b5980687cbabd88f2810a9ace78865f649aefcdb590a08b7c9
MD5 b66aaeb04d521b593e2005610172c65d
SHA1 a7dc733ca634d427a00670f115833f7097822a47
SHA512 6191eb53590430de2f6b258c9fbffc58ba7b2bd0d25ea51530cf3b532184efc1643e3a46940288bc87a98336a0a5454809c100bd50fc18083af7fb87b7c617ab
SSDEEP 6144:iZE1ilcbpf0OEDnbOUr+05F09HNifiNZuvcLXTvGjvYg2PMlNcY:i2wAs1+0g90ivuC78Y
TLSH
T14AB46CA5A6A801FCE177D1B8CA174903F671784A0331AEDF03D099B21F176E59E7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiSetClassInstallParamsA SetupDiOpenDevRegKey SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA CM_Get_Device_IDA SetupDiCallClassInstaller

advapi32

QueryServiceStatus RegDeleteTreeA LookupPrivilegeValueA AdjustTokenPrivileges DeleteService ControlService RegDeleteValueA StartServiceA CreateServiceA RegSetValueExA RevertToSelf RegCloseKey RegOpenKeyExA RegQueryValueExA CloseServiceHandle OpenSCManagerA OpenServiceA SetThreadToken OpenProcessToken GetTokenInformation GetCurrentHwProfileA RegEnumKeyExA DuplicateTokenEx

bcrypt

BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptDeriveKeyPBKDF2 BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider

wevtapi

EvtClearLog

shell32

ShellExecuteExA ord680 ShellExecuteA

kernel32

GetProcessHeap FreeEnvironmentStringsW HeapSize WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW GetEnvironmentStringsW FindNextFileW FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage GetFileAttributesExW CreateProcessW GetExitCodeProcess ReadConsoleInputW SetConsoleMode CreateFileW ReadConsoleW SetCurrentDirectoryA GetTempPathA GetModuleFileNameA LoadResource LockResource SizeofResource FindResourceA SetConsoleCP SetConsoleOutputCP GetStdHandle SetConsoleTextAttribute CreateFileA GetDriveTypeA GetLogicalDrives GetVolumeInformationA CloseHandle DeviceIoControl GetCurrentProcess EnumSystemFirmwareTables GetSystemFirmwareTable QueryDosDeviceA CreateToolhelp32Snapshot Process32First Process32Next GetFileAttributesA ReadFile SetHandleInformation GetLastError CreatePipe WaitForSingleObject Sleep CreateProcessA FlushInstructionCache OpenProcess VirtualAlloc VirtualProtect VirtualFree GetModuleHandleA GetProcAddress DeleteFileA MoveFileExA GetEnvironmentVariableA FindClose FindFirstFileA FindNextFileA GetSystemTimeAsFileTime FreeLibrary LoadLibraryA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead SetFilePointerEx RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

Name

.text

Size

353KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

spoofer.exe

iphlpapi

setupapi

advapi32

bcrypt

wevtapi

shell32

kernel32

generic