Saryx_OGFN_Spoofer_Cracked_by_kyro (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Saryx_OGFN_Spoofer_Cracked_by_kyro (2).exe
Size 2.5MB
Sample261113-3thd8aas3z
SHA256 7a3a0f42c2cf693e1249e63fa5784adc32c7fbe580df1c562c327efe1f790ac6
MD5 3daae8632591b723a7235d7bd41aaa9f
SHA1 94939aa2a823596a768bf8f97c2bc3f287800713
SHA512 f5c16483db0bd0f7adbe63bf115ad2acb40bd1d4e82064685e7bb8e8ef197fa2f504dc423d44af257aa9353009cc9e1ff863dbe152cd153ef7ae880caf374044
SSDEEP 49152:KujlTeqmwbi1mQMXwxX5wOBURYWE1yqM1ghkv5OL:3jRdaMXwxX5wOBURYWtq
TLSH
T198C5BF9E5AAD04ECD2A6C27D855B4707F6F27C5D03209FFB12E08CA40F1B6E5663AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Saryx_OGFN_Spoofer_Cracked_by_kyro (2).exe

File Explorer

Saryx_OGFN_Spoofer_Cracked_by_kyro (2).exe

.exe 2.5MB

Saryx_OGFN_Spoofer_Cracked_by_kyro (2).exe

IMPHASH f37b08ec1f7f9a2c02635e8080071144
SHA256 7a3a0f42c2cf693e1249e63fa5784adc32c7fbe580df1c562c327efe1f790ac6
MD5 3daae8632591b723a7235d7bd41aaa9f
SHA1 94939aa2a823596a768bf8f97c2bc3f287800713
SHA512 f5c16483db0bd0f7adbe63bf115ad2acb40bd1d4e82064685e7bb8e8ef197fa2f504dc423d44af257aa9353009cc9e1ff863dbe152cd153ef7ae880caf374044
SSDEEP 49152:KujlTeqmwbi1mQMXwxX5wOBURYWE1yqM1ghkv5OL:3jRdaMXwxX5wOBURYWtq
TLSH
T198C5BF9E5AAD04ECD2A6C27D855B4707F6F27C5D03209FFB12E08CA40F1B6E5663AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1452048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Loxizz\Documents\all\update\spoofer\ogfnspoofer\x64\Release\ogfnspoof.pdb

kernel32

DeleteCriticalSection CreateThread VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency FreeLibrary SleepEx QueryPerformanceCounter GetTickCount WideCharToMultiByte WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW SetThreadPriority GetThreadPriority IsDebuggerPresent GlobalGetAtomNameA GetBinaryTypeW GetWriteWatch ResetWriteWatch GetThreadContext HeapQueryInformation ReadProcessMemory RtlCaptureContext RaiseException SetThreadContext GetCurrentThreadId K32GetModuleInformation GetLocalTime SystemTimeToFileTime CheckRemoteDebuggerPresent GetSystemFirmwareTable EnumSystemFirmwareTables DuplicateHandle DebugBreak K32GetProcessImageFileNameW LoadLibraryExA CreateMutexA GetModuleHandleExA WriteProcessMemory Thread32Next Thread32First SuspendThread OpenThread InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind GetProcessHeap SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx VirtualAlloc VirtualFree GetExitCodeProcess FlushFileBuffers SetUnhandledExceptionFilter GetDriveTypeW VirtualQuery SetConsoleTitleW SetConsoleCursorPosition GetFirmwareType K32EnumProcessModules GetSystemTimeAsFileTime GetModuleHandleW CreateProcessW GetCurrentProcessId GetFileSize MoveFileExW LocalFree SetFilePointerEx GetProcAddress GetWindowsDirectoryW FillConsoleOutputAttribute LoadLibraryW GetSystemInfo CloseHandle Process32FirstW DeleteFileW FillConsoleOutputCharacterW Process32NextW GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess ResumeThread GetSystemDirectoryW SetComputerNameExW GetFileAttributesW CreateFileW WaitForSingleObject FindClose GetTempPathW GetEnvironmentVariableW SetFilePointer K32GetModuleFileNameExW AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA InitializeCriticalSectionEx HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler RtlLookupFunctionEntry GetModuleHandleA GetModuleFileNameW TerminateProcess DeviceIoControl WriteFile GetStdHandle GetCurrentProcess FindNextFileW SetPriorityClass GetConsoleScreenBufferInfo GetFileSizeEx FindFirstFileW GetLogicalDrives ReadFile RemoveVectoredExceptionHandler CreateDirectoryW OutputDebugStringW

user32

MessageBoxA wsprintfW GetWindowTextA GetForegroundWindow EnumWindows FindWindowA CloseWindow

advapi32

InitializeAcl RegQueryValueExW QueryServiceStatusEx GetLengthSid OpenServiceW RegDeleteValueW ChangeServiceConfigW RegGetValueW RegOpenKeyExW StartServiceW OpenProcessToken RegSetValueExW RegDeleteTreeW RegEnumKeyExW ControlService CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid GetTokenInformation AddAccessAllowedAce RegSetKeyValueW RegOpenKeyW RegCreateKeyExW RegCopyTreeW RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CloseServiceHandle OpenSCManagerW CopySid

shell32

SHGetFolderPathW ShellExecuteA SHFileOperationW

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$ctype@_W@std@@2V0locale@2@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_sleep ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z

ntdll

NtQuerySystemInformation NtUnloadDriver RtlAdjustPrivilege NtLoadDriver RtlInitUnicodeString

shlwapi

StrStrIW SHDeleteValueW StrStrW SHDeleteKeyW PathFindFileNameW

tbs

Tbsi_GetDeviceInfo

urlmon

URLDownloadToFileW

bcrypt

BCryptGenRandom

setupapi

CM_Get_DevNode_Status SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiGetClassDevsW CM_Get_Parent SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiCallClassInstaller CM_Get_Device_IDW SetupDiSetClassInstallParamsW CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupDiDestroyDeviceInfoList

ncrypt

NCryptDeleteKey NCryptOpenStorageProvider NCryptFreeObject NCryptOpenKey

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

ws2_32

ntohs inet_pton WSACleanup closesocket WSAWaitForMultipleEvents bind connect WSASetLastError getsockopt gethostname ioctlsocket sendto inet_ntop freeaddrinfo getpeername getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname recvfrom WSAStartup WSAGetLastError WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler wcschr strstr strrchr strchr memset memcpy memcmp _CxxThrowException __std_terminate wcsstr __std_exception_copy __std_exception_destroy __current_exception_context memmove memchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _close _wopen _wfopen __stdio_common_vfwprintf _write _read __p__commode _lseeki64 fgetc __stdio_common_vfprintf ftell fseek feof _fileno _fseeki64 __stdio_common_vsnwprintf_s fclose _popen _pclose fgets fwrite __stdio_common_vsprintf fgetpos setvbuf ungetc fsetpos fflush __acrt_iob_func _set_fmode __stdio_common_vswprintf_s fread fputc _get_stream_buffer_pointers fputs

api-ms-win-crt-heap-l1-1-0

calloc free realloc _callnewh _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-string-l1-1-0

strpbrk _strdup wcscpy_s wcsncmp wcscat_s strcmp strspn wcspbrk wcsncpy iswxdigit towlower _stricmp strncmp strcspn _wcsicmp tolower _wcsdup

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _seh_filter_exe _cexit _crt_atexit _errno terminate _initterm_e _register_onexit_function _invalid_parameter_noinfo_noreturn system __sys_errlist __sys_nerr _initialize_onexit_table exit _beginthreadex abort _invalid_parameter_noinfo _invoke_watson _resetstkoflw _get_initial_narrow_environment _exit _configure_narrow_argv _initialize_narrow_environment __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _lock_file _unlock_file _wstat64 _wremove

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 _localtime64 strftime

api-ms-win-crt-math-l1-1-0

_dclass _fdopen _dsign __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoull atoi strtoul wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv