Spoof extra fr[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Spoof extra fr.exe
Size 19KB
Sample261026-zs6tmsgv8z
SHA256 67e850bcad881f08696010ea715692c7c4efb1cdc4c02fe31d88f24436b356da
MD5 c52ba4f3cb56401ced9001156159f8a3
SHA1 8af73f5a7f402605f57e62fc5d1c740cd8229417
SHA512 554ec10cf4de7232d39a1a0b13d1db3855fdb75c0e7c11cdd2862db4ad9b0e7785fb0de64d42a9a14fcc77abf3bf636ced0087caa7ab650b5a468d6b08a5c129
SSDEEP 192:NjMF1e7sRGO15mhui/L8bSvkyMVGXx86Bb8xboW/ER6BETY/3W5XfbgAO:NYF47sRVSui/Li0Xx866oWO6+TscO
TLSH
T1AB921953B7E20AE6F17AE27585F35518E672B9456B32D6CF2342402E0F71BC06E3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoof extra fr.exe

File Explorer

Spoof extra fr.exe

.exe 19KB

Spoof extra fr.exe

IMPHASH 67bf7f652f65e3df6579509fb1d629f1
SHA256 67e850bcad881f08696010ea715692c7c4efb1cdc4c02fe31d88f24436b356da
MD5 c52ba4f3cb56401ced9001156159f8a3
SHA1 8af73f5a7f402605f57e62fc5d1c740cd8229417
SHA512 554ec10cf4de7232d39a1a0b13d1db3855fdb75c0e7c11cdd2862db4ad9b0e7785fb0de64d42a9a14fcc77abf3bf636ced0087caa7ab650b5a468d6b08a5c129
SSDEEP 192:NjMF1e7sRGO15mhui/L8bSvkyMVGXx86Bb8xboW/ER6BETY/3W5XfbgAO:NYF47sRVSui/Li0Xx866oWO6+TscO
TLSH
T1AB921953B7E20AE6F17AE27585F35518E672B9456B32D6CF2342402E0F71BC06E3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\apina\Downloads\Spoof extra fr\x64\Release\Spoof extra fr.pdb

kernel32

Sleep RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

advapi32

FreeSid RegCloseKey RegQueryValueExW RegDeleteValueW RegOpenKeyExW CheckTokenMembership RegDeleteTreeW RegSetValueExW AllocateAndInitializeSid

msvcp140

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __current_exception _CxxThrowException __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit __p___argc _register_thread_local_exe_atexit_callback _c_exit _invoke_watson _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _cexit _seh_filter_exe __p___wargv terminate _set_app_type

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale