Spoofer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spoofer.exe
Size 1.8MB
Sample261110-zhy12sba65
SHA256 a3a6f770283fddbb001e3862eb7eba52b0e04624f0c0932e80905948c24c0ebb
MD5 6dafa1c0eb2d064f28c422b5d1ec7af3
SHA1 25dbd699d43ba2d893d62611d57fbad61c3cc8ae
SHA512 c27464a901a37c924ed253f1aac5230126277a141d56c0c2c8b7d8a91bb47b6fe98ec5811a97894ab19876985410c9242fb54b61e3336146509526fad262cb2f
SSDEEP 24576:/ofeYncu+gbtW9qEUcH3+yAZjcbEMc/2Gu5stdxmjOvxuKPOY/ct9Xms48icdN85:cbyD7eCmlzZfFX
TLSH
T18F859DEC469C45BCE315C638A58A5387F3F3BE8E96A8EFB52AD05CA54C2F480F235445
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spoofer.exe

File Explorer

Spoofer.exe

.exe 1.8MB

Spoofer.exe

IMPHASH c630d2d17ca46f3d7c9fc78f9684241d
SHA256 a3a6f770283fddbb001e3862eb7eba52b0e04624f0c0932e80905948c24c0ebb
MD5 6dafa1c0eb2d064f28c422b5d1ec7af3
SHA1 25dbd699d43ba2d893d62611d57fbad61c3cc8ae
SHA512 c27464a901a37c924ed253f1aac5230126277a141d56c0c2c8b7d8a91bb47b6fe98ec5811a97894ab19876985410c9242fb54b61e3336146509526fad262cb2f
SSDEEP 24576:/ofeYncu+gbtW9qEUcH3+yAZjcbEMc/2Gu5stdxmjOvxuKPOY/ct9Xms48icdN85:cbyD7eCmlzZfFX
TLSH
T18F859DEC469C45BCE315C638A58A5387F3F3BE8E96A8EFB52AD05CA54C2F480F235445
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1724928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetComputerNameExW CreateFileA CloseHandle SetFilePointer GetModuleHandleW FlushFileBuffers FormatMessageA DeviceIoControl WriteFile ReadFile GetModuleFileNameW GetStdHandle SetConsoleTextAttribute Beep Sleep GetProcAddress SetConsoleTitleA GetLocaleInfoEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter CreateDirectoryW CreateFileW FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent LocalFree

advapi32

RegCloseKey RegQueryValueExA RegFlushKey RegSetValueExA RegOpenKeyExA RegEnumKeyExA AllocateAndInitializeSid FreeSid CheckTokenMembership

shell32

SHGetFolderPathA ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset memcpy __current_exception_context memcmp __std_exception_copy __std_exception_destroy __std_terminate __current_exception _CxxThrowException memmove

api-ms-win-crt-runtime-l1-1-0

_cexit _crt_atexit _initterm_e _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm exit _exit abort __p___argc _get_initial_narrow_environment __p___argv _invoke_watson system _register_thread_local_exe_atexit_callback _errno _set_app_type _register_onexit_function _seh_filter_exe _c_exit terminate

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

fgetc _pclose _set_fmode fclose fflush fgetpos fputc fgets _popen ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers __p__commode setvbuf fwrite

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Spoofer.exe

kernel32

advapi32

shell32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic