spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spoofer.exe
Size 3.3MB
Sample261027-tyzpmaev7v
SHA256 f16e5c1d61b993b015a08acd20895f18c0a63ea7ff11dbb51d0fe64a48968b93
MD5 ab9853c135593fa1d531ee0d0298b12f
SHA1 e44cbbb9239ee24b075f5354ff6750c28d60d9b0
SHA512 c8066a32f4441d5d3d27712ec27340e2c26c91ec7788c5e5322b48810950672bb43dd45f555eec027926696614be0e594af24abaef9acafa73a92d35b6de932f
SSDEEP 49152:ThnQETgOum01hXdChf4y3VLuxuMvAKrTZrNyAk2dEzkhT8pF08sP:lQEh1jVqxdAGTZ10tQP
TLSH
T15BF5DF16A29B42A8DFB29B3888949673D6B13CC943B0C6E71ADC49752F279F45F3C311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoofer.exe

File Explorer

spoofer.exe

.exe 3.3MB

spoofer.exe

IMPHASH b4074924170f4509524c5cf48fc01267
SHA256 f16e5c1d61b993b015a08acd20895f18c0a63ea7ff11dbb51d0fe64a48968b93
MD5 ab9853c135593fa1d531ee0d0298b12f
SHA1 e44cbbb9239ee24b075f5354ff6750c28d60d9b0
SHA512 c8066a32f4441d5d3d27712ec27340e2c26c91ec7788c5e5322b48810950672bb43dd45f555eec027926696614be0e594af24abaef9acafa73a92d35b6de932f
SSDEEP 49152:ThnQETgOum01hXdChf4y3VLuxuMvAKrTZrNyAk2dEzkhT8pF08sP:lQEh1jVqxdAGTZ10tQP
TLSH
T15BF5DF16A29B42A8DFB29B3888949673D6B13CC943B0C6E71ADC49752F279F45F3C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileA

ntdll

RtlUnwind NtQuerySystemInformation RtlAdjustPrivilege NtUnloadDriver NtLoadDriver RtlInitUnicodeString RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader

shlwapi

SHDeleteKeyW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiCallClassInstaller CM_Get_Parent CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupDiOpenDevRegKey CM_Get_DevNode_Status SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiSetClassInstallParamsW

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

AllocConsole GetSystemFirmwareTable GetLogicalDrives FindFirstFileA VirtualFree GetCurrentProcess WriteFile DeviceIoControl VirtualAlloc SetFileTime GetModuleFileNameW FindNextFileA GetEnvironmentVariableW SetEndOfFile GetTempPathW FindClose WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW Sleep GetTempPathA GetTickCount64 CopyFileA GetFileAttributesA LoadLibraryA DeleteFileA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW LocalFree GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary CopyFileW GetTempFileNameW GetTempFileNameA GetDriveTypeW GetExitCodeProcess GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryExW GetCurrentThreadId GetOEMCP GetACP IsValidCodePage HeapSize HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetSystemTimeAsFileTime VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ReadFile FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError SetConsoleOutputCP DeleteCriticalSection GetProcAddress DecodePointer GetStdHandle SetConsoleTitleA GetModuleFileNameA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException OutputDebugStringW IsDebuggerPresent GetCPInfo WakeAllConditionVariable LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection SetStdHandle WriteConsoleW InitializeCriticalSectionEx GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetStringTypeW FreeConsole GetLastError GetConsoleMode GetModuleHandleA MultiByteToWideChar CompareStringW SetConsoleMode GetFileInformationByHandleEx MoveFileExW AreFileApisANSI SetFileInformationByHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetCommandLineA

user32

SetClipboardData EmptyClipboard DefWindowProcW SetWindowLongA DispatchMessageW GetWindowLongW CloseClipboard GetClipboardData GetWindowRect DestroyWindow ShowWindow CreateWindowExW GetSystemMetrics PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow UnregisterClassW OpenClipboard RegisterClassExW GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor

advapi32

SetEntriesInAclW RegSetKeyValueW RegCreateKeyW RegOpenKeyW AdjustTokenPrivileges GetAclInformation RegDeleteKeyW AllocateAndInitializeSid LookupPrivilegeValueA RegCreateKeyExW SetNamedSecurityInfoW CopySid GetNamedSecurityInfoW ConvertStringSidToSidW RegSaveKeyW RegDeleteTreeW IsValidSid OpenProcessToken FreeSid RegRestoreKeyW RegDeleteValueW GetLengthSid IsValidAcl RegEnumValueW RegCloseKey RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

ole32

CoCreateInstance StringFromGUID2 CoInitialize CLSIDFromString

oleaut32

SysFreeString

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

943KB

Virtual Size

942KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

97KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

spoofer.exe

urlmon

ntdll

shlwapi

setupapi

d3d11

dwmapi

kernel32

user32

advapi32

ole32

oleaut32

winhttp

imm32

d3dcompiler_47

generic