OceanWin Spoofer.rar
- SHA256 7d0911cf26b32b4b77de8072be5b2eeb6f5bbbe981933c5643a0dd596dc3358f
Password
123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XD.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
crack_attempt.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target OceanWin Spoofer.rar
- Size 35.0MB
- Sample261017-1pre8azyey
- SHA256 7d0911cf26b32b4b77de8072be5b2eeb6f5bbbe981933c5643a0dd596dc3358f
- MD5 d311de1c6ae77891ba529b9198dbbc1a
- SHA1 42a2d46934612857699e4b524c5341efacbd8e57
- SHA512 7d805d6cd088f38f79b06bf62ccfb23835b4e106fe65cd956afafc0c9ada81fa219f3c246c037c119c487fa9874ca7f41f3385914ed1e990d890a77924e76c12
- SSDEEP 786432:5Oudsi9/i79WKSbDYsIvxPRnGvWPFZ2Y/3f5/A36fIdlQ:5Os39/TDYRvxsvWPFQG3f5436fIdlQ
- TLSH T1BA87338D3824791F7656500A9C6C2390B82BD4EA77ECD76C89DAF4C08747BB148B7DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/XD.exe unpack001/crack_attempt.ldr
File Explorer
-
OceanWin Spoofer.rar.rar 35.0MB
-
XD.exe.exe 13.8MB
-
crack_attempt.ldr.exe 26.9MB
XD.exe
- IMPHASH 79cf67b70d66b070f3ade58f2954986b
- SHA256 68756011ba8e14bef18e188b2a5f5dccbcb0d6c4aa552c99fcde41887f828175
- MD5 6801fb25d54fd349f808761373217ab6
- SHA1 3889ca95f780abb77d0655d2ec886f79169ba3f2
- SHA512 e45418f75c6466ceb55a122c31563096f7e4f2a621976617c17099ecf9664a6cc53da398e745205d62633a53f396020e792863ed729f4bf46ae6d02fe932b3ee
- SSDEEP 393216:ogJ1H45414sRe+kGt+vOX+UiywBDzHJki4:BLHGt+F+vlUi1HJO
- TLSH T19CE623D53EC6A26CC0B3CB14728A176970F2B7CDC1FE4E2E36C71C0266A1E579E5581A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
12514463
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Module32Next
advapi32
LookupPrivilegeValueA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
crack_attempt.ldr
- IMPHASH 4886b8fb5b4471466e2ecd47320efc72
- SHA256 73f555f1c1c64c713791393cf2f10ad24b6f5b1f94bc9c207c03cfe9bb5a63fe
- MD5 d5cd8a8e7badcdba42b2437b7585d0da
- SHA1 06603e938b306bba5978d3e32d1fb15241bdadfd
- SHA512 8b3b9a8670c367a268304b59bcedace897601162474f347fc90d591958af65a46b3d5622d6ead56859ae533b8c237632eaedbc1e55ccbbc4d4b10673a0c39c9a
- SSDEEP 393216:YY0pntXIgoibDuIUx5hsYUXoKzEuYT1EtrqnR+ks0DvPROMgm2ej+WC:YtpFoQuICmyuYS5qR+kvDvcMgm2ej+b
- TLSH T14057235BE9F6E2D4C7434A70A7C61AC923D1A1998EDD853C35CE1C027831EA789C9E73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
35982863
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateFileMappingW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ShowWindow
advapi32
CryptImportKey
ole32
CoSetProxyBlanket
oleaut32
VariantClear
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
iphlpapi
GetAdaptersInfo
winhttp
WinHttpQueryDataAvailable
ntdll
RtlVirtualUnwind
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertGetCertificateChain
ws2_32
listen
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
ceilf
shell32
ShellExecuteA
Name
.text
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.%Wu
Size
Virtual Size
15.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.}cn
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.$WQ
Size
26.7MB
Virtual Size
26.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ