Nivex FN Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Nivex FN Spoofer.exe
Size 2.5MB
Sample261026-sa4s1abc93
SHA256 336fcdc286b232bb80f95ad4385dba86624754609eda901058cbd09f502a954f
MD5 8b25476172ae39ef0d262eab60e77173
SHA1 70ce90c0610704f2460df7d3278bc98b00b39fbb
SHA512 81964b00047c0b37fba1f9e5b9a1659afb93f5e483e830d3fdfae2ce06b8cedd126a133fe6d986440c9541e02817074738119cb581ae2971ee9029bbfb9e9af2
SSDEEP 49152:CQH8kcPd9gwQoF5b3AhWA6bmvjlOPyWnbeEGn2wf:zepF5b3AhNhOPyWqEG2q
TLSH
T1D8C5120AEB575CF9CAB6D1B88552652EFE3274CA43B097CBA3C549470B177E8A93D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nivex FN Spoofer.exe

File Explorer

Nivex FN Spoofer.exe

.exe 2.5MB

Nivex FN Spoofer.exe

IMPHASH 58c5cc69f17515a6e48ae1be79ebc0d7
SHA256 336fcdc286b232bb80f95ad4385dba86624754609eda901058cbd09f502a954f
MD5 8b25476172ae39ef0d262eab60e77173
SHA1 70ce90c0610704f2460df7d3278bc98b00b39fbb
SHA512 81964b00047c0b37fba1f9e5b9a1659afb93f5e483e830d3fdfae2ce06b8cedd126a133fe6d986440c9541e02817074738119cb581ae2971ee9029bbfb9e9af2
SSDEEP 49152:CQH8kcPd9gwQoF5b3AhWA6bmvjlOPyWnbeEGn2wf:zepF5b3AhNhOPyWqEG2q
TLSH
T1D8C5120AEB575CF9CAB6D1B88552652EFE3274CA43B097CBA3C549470B177E8A93D300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2634240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThread GetCurrentThreadId SetThreadPriority ResumeThread CreateProcessA GetThreadContext SetThreadContext FlushInstructionCache OpenProcess GetTickCount GetSystemDirectoryA VirtualAlloc VirtualProtect VirtualFree VirtualQuery VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualLock VirtualUnlock GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA lstrcpynA lstrlenA QueryFullProcessImageNameA FindResourceA MoveFileExA SetConsoleMode FlushConsoleInputBuffer GetConsoleWindow CreateToolhelp32Snapshot CreateRemoteThread Process32Next Module32First Module32Next K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleInformation CreateThread TerminateProcess ExitProcess GetCurrentProcessId GetCurrentProcess Sleep WaitForSingleObject AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter CloseHandle CheckRemoteDebuggerPresent IsDebuggerPresent GetTempPathA ReadFile DeleteFileA CreateFileA GetCommandLineA InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection RemoveVectoredExceptionHandler GetSystemInfo AddVectoredExceptionHandler LocalFree DeleteCriticalSection Process32First GetStdHandle

user32

MessageBoxA EnableWindow ShowWindow GetWindowTextA FindWindowA EnumWindows GetClassNameA

advapi32

CryptAcquireContextA CryptVerifySignatureW CryptAcquireContextW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptGenRandom FreeSid CheckTokenMembership AllocateAndInitializeSid CryptDestroyKey

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfo

urlmon

URLDownloadToFileA

winhttp

WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpSetOption WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpReadData

msvcp140

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_lock _Mtx_unlock ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Query_perf_frequency _Query_perf_counter ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

vcruntime140

__current_exception_context __std_exception_copy __current_exception __std_terminate memchr memcmp __C_specific_handler memmove memset _CxxThrowException strstr memcpy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _c_exit _set_app_type _seh_filter_exe _cexit __p___argv _configure_narrow_argv terminate _beginthreadex _crt_atexit _invalid_parameter_noinfo_noreturn _register_onexit_function _initialize_onexit_table _initialize_narrow_environment __p___argc

api-ms-win-crt-string-l1-1-0

tolower _stricmp strlen strcpy_s strcmp

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

strtol atoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _get_stream_buffer_pointers fclose fflush fgetc __stdio_common_vsnprintf_s _set_fmode fputc ungetc setvbuf fwrite _fseeki64 fsetpos fread fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

196KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Nivex FN Spoofer.exe

kernel32

user32

advapi32

crypt32

urlmon

winhttp

msvcp140

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic