261023-wvkgmsztex_pw_infected[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
261023-wvkgmsztex_pw_infected.zip
Size 1017KB
Sample261024-kaej4stsat
SHA256 f147cae0601ce9b9dca8d8d0382cb11a92d3e4f19a981ce8a6f43170755fe9d9
MD5 5f0e1e60e31497f3eb4d17a94c356e93
SHA1 99c7a759c0efe822a2edafb4056ea77153d7c2c8
SHA512 7c931087859c508b8d87df67dd2215a77bcce14db2d54ad73fc15c4772800bdd2596f9d97ff650712e5715aa9d8da7a988cf882ab6767fd478d3b62887ab090b
SSDEEP 24576:+/ftOYjlafeXLKNwAr8PSHwNjyYjp3uh6QSZAGVW0up2wP:+/fwwlQeO+ArGQMLN+hDV0upv
TLSH
T1AD2533430AD2221ABD074C8BF3679E3A91F2D503A4C67D86C2FD5AF199B485BCF5602D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack003/AlexSpoofer.exe

File Explorer

261023-wvkgmsztex_pw_infected.zip

.zip 1017KB
261023-wrag9sdd27_pw_infected.zip

.zip 1016KB
261023-snh4fsex2k_pw_infected.zip

.zip 1016KB
AlexSpoofer.exe

.exe 1.8MB

261023-wvkgmsztex_pw_infected.zip

SHA256 f147cae0601ce9b9dca8d8d0382cb11a92d3e4f19a981ce8a6f43170755fe9d9
MD5 5f0e1e60e31497f3eb4d17a94c356e93
SHA1 99c7a759c0efe822a2edafb4056ea77153d7c2c8
SHA512 7c931087859c508b8d87df67dd2215a77bcce14db2d54ad73fc15c4772800bdd2596f9d97ff650712e5715aa9d8da7a988cf882ab6767fd478d3b62887ab090b
SSDEEP 24576:+/ftOYjlafeXLKNwAr8PSHwNjyYjp3uh6QSZAGVW0up2wP:+/fwwlQeO+ArGQMLN+hDV0upv
TLSH
T1AD2533430AD2221ABD074C8BF3679E3A91F2D503A4C67D86C2FD5AF199B485BCF5602D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

AlexSpoofer.exe

IMPHASH 1fb14f1f53ec0d7bdf7764d26b40f48e
SHA256 b4a78d496eac9f183784ad2d6406661801dfc6ff719560756645dfd3dc6c683b
MD5 4e825cd62fcc4621889a814fb567371d
SHA1 86d52d0573500ecf7a825588f9851f846dbce588
SHA512 c0cf0bc323feaefe7e248577ba579a11adb0e06ce8e2a559e16918057d5519ec16b324b7eac59542c9cc8cc29682a4cd6240c039f1491937691942018caf588b
SSDEEP 49152:dP5BtkTHfCQAbX5cIk84msLL9a1CGiicJfaU:zBtkbC5b5N
TLSH
T19D95BE47F7D689EDC753A13886229317E6B0B82117218BCB27E0AB92DF636D09F75311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

724124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\kazim\Desktop\Spoofer\Alex Spoofer1\AlexSpoofer\Build\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

FindResourceW GetCurrentProcessId CreateDirectoryA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile LoadResource CreateFileMappingA GetTempPathA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError LocalFree CloseHandle LoadLibraryW WaitForSingleObject SizeofResource GetModuleHandleW UnmapViewOfFile LockResource GetProcAddress FreeLibrary GetVolumeInformationA GetComputerNameA Sleep ReleaseSRWLockExclusive

user32

UpdateWindow DestroyWindow GetKeyState GetMessageExtraInfo GetWindowRect ScreenToClient GetCapture ClientToScreen PostQuitMessage TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect MoveWindow GetSystemMetrics IsWindowUnicode TranslateMessage DefWindowProcW CreateWindowExW GetWindowLongW UnregisterClassW RegisterClassExW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ShowWindow DispatchMessageW SetCursorPos SetWindowLongA ReleaseCapture PeekMessageW SetLayeredWindowAttributes

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_detach ?good@ios_base@std@@QEBA_NXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

iphlpapi

GetAdaptersInfo

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr strstr __std_exception_copy __std_terminate __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _crt_atexit _invoke_watson _configure_narrow_argv _initialize_narrow_environment exit terminate

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsprintf_s fclose __p__commode fputc fgetc __stdio_common_vsscanf __stdio_common_vsprintf _wfopen _set_fmode __stdio_common_vfprintf fseek __acrt_iob_func ftell fwrite _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy wcslen strlen

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

ceilf cosf fmodf sqrtf acosf sinf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale