PermSpoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PermSpoofer.exe
Size 2.3MB
Sample261110-16pmysbf89
SHA256 c94f9a8bc1c4093f573409616f1cfcd19c702f892926e2d5d23ef10fed476b23
MD5 021d99f39e706d0595ce67dde79d65f3
SHA1 f1f28b3783972bb370acbf526e835783d3b70073
SHA512 d1718c203b018ed36c9d33cd139c31de2d462e6b265e37fc741f899466c529d31e8879b6700b7ba739904532e7d63b0a222e576ecaf1a09ceb00d7f87c2702e4
SSDEEP 49152:6I8Z/0rneJH0v4UIm/aSJi1byw+NXqBVeP:09I/aKwK8e
TLSH
T112B5CF03B3DE8628D17769788AB7C362B333BC415B21828B77A405649E931E45F7B7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PermSpoofer.exe

File Explorer

PermSpoofer.exe

.exe 2.3MB

PermSpoofer.exe

IMPHASH 841ed8d15a2de903c7d8924d1f603b16
SHA256 c94f9a8bc1c4093f573409616f1cfcd19c702f892926e2d5d23ef10fed476b23
MD5 021d99f39e706d0595ce67dde79d65f3
SHA1 f1f28b3783972bb370acbf526e835783d3b70073
SHA512 d1718c203b018ed36c9d33cd139c31de2d462e6b265e37fc741f899466c529d31e8879b6700b7ba739904532e7d63b0a222e576ecaf1a09ceb00d7f87c2702e4
SSDEEP 49152:6I8Z/0rneJH0v4UIm/aSJi1byw+NXqBVeP:09I/aKwK8e
TLSH
T112B5CF03B3DE8628D17769788AB7C362B333BC415B21828B77A405649E931E45F7B7D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

FreeLibrary QueryPerformanceCounter SetConsoleTitleA GetCurrentProcess TerminateProcess K32GetModuleFileNameExW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle LoadLibraryW GetCurrentProcessId GetConsoleWindow CreateProcessA K32EnumProcessModules GetTickCount IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent WideCharToMultiByte GetModuleHandleW GetLastError QueryPerformanceFrequency GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetProcAddress LoadLibraryA GlobalLock GlobalUnlock GlobalFree GlobalAlloc MultiByteToWideChar GetFileInformationByHandleEx ReleaseSRWLockExclusive AreFileApisANSI AcquireSRWLockExclusive

user32

SetWindowLongA GetWindowLongW GetWindowThreadProcessId DefWindowProcW FindWindowExW SetClipboardData GetClipboardData EmptyClipboard PeekMessageW GetWindowRect MoveWindow SetLayeredWindowAttributes TranslateMessage ShowWindow RegisterClassExW LoadIconW UnregisterClassW PostQuitMessage UpdateWindow GetWindowTextW GetKeyState DestroyWindow CreateWindowExW ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect GetSystemMetrics IsWindowUnicode ReleaseCapture SetCursorPos DispatchMessageW GetCursorPos OpenClipboard CloseClipboard

advapi32

GetUserNameA RegOpenKeyExA GetUserNameW RegCloseKey RegQueryValueExA

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpConnect

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntryA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr wcsrchr strstr __std_terminate __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _pclose fgetpos fsetpos feof ungetc fputc _fseeki64 _popen fgets __p__commode _set_fmode __stdio_common_vsscanf fread setvbuf __stdio_common_vsprintf _wfopen fwrite ftell __stdio_common_vfprintf fseek fclose fflush fgetc __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _wassert __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _errno exit _beginthreadex terminate abort system _invoke_watson _register_onexit_function

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncmp towlower _wcsicmp toupper isspace isalnum strncpy strcmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_localtime64_s _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

cosf ceilf acosf powf fmodf sinf sqrtf __setusermatherr