Edit tour

Windows Analysis Report
SPOOOFER776.exe

Overview

General Information

Sample name:	SPOOOFER776.exe
Analysis ID:	1590903
MD5:	66a9fe0ffb298b4c4c390dee3bc534e9
SHA1:	5dc498039926c0c342c536d3cccf1e5c1dd752d8
SHA256:	0fc0de254bc80e54c708fbd0eb0460c730283508b94108e4b2d1d70525ef3fce
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SPOOOFER776.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\SPOOOFER776.exe" MD5: 66A9FE0FFB298B4C4C390DEE3BC534E9)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SPOOOFER776.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
SPOOOFER776.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
SPOOOFER776.exe	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x551718:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x551798:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x55181d:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x551c82:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x551d3a:$s2: Set-MpPreference -DisableArchiveScanning $true 0x551dda:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x551e78:$s4: Set-MpPreference -DisableScriptScanning $true 0x551f02:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x551f70:$s6: Set-MpPreference -MAPSReporting 0 0x551fe8:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x552086:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x552114:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x55219e:$s10: Set-MpPreference -SevereThreatDefaultAction 6

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000000.1864156282.0000000000F4D000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SPOOOFER776.exe PID: 6904	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SPOOOFER776.exe.7c70000.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SPOOOFER776.exe.4aa15f0.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SPOOOFER776.exe.66f0000.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SPOOOFER776.exe.4fa1610.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.SPOOOFER776.exe.d50000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.0.SPOOOFER776.exe.d50000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.SPOOOFER776.exe.d50000.0.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x551718:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x551798:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x55181d:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x551c82:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x551d3a:$s2: Set-MpPreference -DisableArchiveScanning $true 0x551dda:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x551e78:$s4: Set-MpPreference -DisableScriptScanning $true 0x551f02:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x551f70:$s6: Set-MpPreference -MAPSReporting 0 0x551fe8:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x552086:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x552114:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x55219e:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 2 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SPOOOFER776.exe	Virustotal: Detection: 73%			Perma Link
Source: SPOOOFER776.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: SPOOOFER776.exe

Joe Sandbox ML: detected

Source: SPOOOFER776.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: SPOOOFER776.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Spoofer Valorant C#\Spoofer Valorant Atual\SpooferAtualizado\obj\Release\SPOOOFER.pdb source: SPOOOFER776.exe
Source:	Binary string: $iq.costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: costura.costura.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: Siticone.Desktop.UI.pdb source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Spoofer Valorant C#\Spoofer Valorant Atual\SpooferAtualizado\obj\Release\SPOOOFER.pdbBdU^dU PdU_CorExeMainmscoree.dll source: SPOOOFER776.exe
Source:	Binary string: guna.ui2?costura.guna.ui2.dll.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: Siticone.Desktop.UI.pdb8@N@ @@_CorDllMainmscoree.dll source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: SPOOOFER776.exe
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: SPOOOFER776.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: SPOOOFER776.exe, type: SAMPLE
Source: Yara match	File source: 0.2.SPOOOFER776.exe.7c70000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPOOOFER776.exe.4aa15f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPOOOFER776.exe.66f0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPOOOFER776.exe.4fa1610.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.SPOOOFER776.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

HTTP traffic detected: POST /api/1.0/ HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: keyauth.winContent-Length: 396Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.0/ HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: keyauth.winContent-Length: 396Expect: 100-continueConnection: Keep-Alive

Source: SPOOOFER776.exe	String found in binary or memory: http://167.114.85.75/logo.zip
Source: SPOOOFER776.exe	String found in binary or memory: http://167.114.85.75/mac.bat
Source: SPOOOFER776.exe	String found in binary or memory: http://167.114.85.75/tpmbypassspoofer.exe
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gdata.youtube.com/feeds/api/videos/
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://keyauth.win
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://keyauth.wind
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/KeyAuth
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/KeyAuthd
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/video/
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SPOOOFER776.exe	String found in binary or memory: https://api.ipify.org)Nome
Source: SPOOOFER776.exe	String found in binary or memory: https://discord.com/api/webhooks/1222693252319416370/7HHFXJ3XDvpPWnJrESXq2ra2rQYgEisxjWubp5mRiRjzLmM
Source: SPOOOFER776.exe	String found in binary or memory: https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AFUWINx64.EXE
Source: SPOOOFER776.exe	String found in binary or memory: https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AMIDEWINx64.exe
Source: SPOOOFER776.exe	String found in binary or memory: https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AMIFLDRV64.sys
Source: SPOOOFER776.exe	String found in binary or memory: https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/Volumeid64.exe
Source: SPOOOFER776.exe	String found in binary or memory: https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/amifldrv64_1.sys
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/LRiq
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/api/licensing.php
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/api/licensing.phpLRiq
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/pricing
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunaui.com/pricingLRiq(pf
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.0/
Source: SPOOOFER776.exe	String found in binary or memory: https://keyauth.win/api/1.0/aYou
Source: SPOOOFER776.exe	String found in binary or memory: https://keyauth.win/api/1.1/
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.siticoneframework.com/api/licensing.php
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.siticoneframework.com/api/licensing.php%Siticone
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.siticoneframework.com/Mhttps://siticoneframework.com/pricing/Mhttps://siticoneframework.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.4:49738 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: SPOOOFER776.exe, type: SAMPLE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.0.SPOOOFER776.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_01C2E40C	0_2_01C2E40C
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0E798	0_2_06B0E798
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0A239	0_2_06B0A239
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0CDE3	0_2_06B0CDE3
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B07DD8	0_2_06B07DD8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B09918	0_2_06B09918
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0E788	0_2_06B0E788
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B00A90	0_2_06B00A90
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B00A80	0_2_06B00A80
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0A8F8	0_2_06B0A8F8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B09570	0_2_06B09570
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B09563	0_2_06B09563
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0BE72	0_2_06B0BE72
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0BCF0	0_2_06B0BCF0
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0DDA8	0_2_06B0DDA8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0BD89	0_2_06B0BD89
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B07DD6	0_2_06B07DD6
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B07DC8	0_2_06B07DC8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0BD00	0_2_06B0BD00
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0BD5F	0_2_06B0BD5F
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B09908	0_2_06B09908
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09212AA8	0_2_09212AA8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09219F90	0_2_09219F90
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0921CE94	0_2_0921CE94
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0921D978	0_2_0921D978
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09212A98	0_2_09212A98
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_092120E0	0_2_092120E0
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_092120F0	0_2_092120F0
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0921E638	0_2_0921E638
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996E9B4	0_2_0996E9B4
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996E9E4	0_2_0996E9E4
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09964B3C	0_2_09964B3C
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996FAF1	0_2_0996FAF1
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09968A64	0_2_09968A64
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996EA64	0_2_0996EA64
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_099660F8	0_2_099660F8
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996F2D0	0_2_0996F2D0
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_0996F492	0_2_0996F492
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09963650	0_2_09963650
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09963641	0_2_09963641
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09969679	0_2_09969679
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B379A0	0_2_09B379A0
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B3799C	0_2_09B3799C
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B39408	0_2_09B39408

Source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.Desktop.UI.dllH vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGuna.UI2.dllD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.Desktop.UI.dllH vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSPOOOFER.exeD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1978520100.0000000006DB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGuna.UI2.dllD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGuna.UI2.dllD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.Desktop.UI.dllH vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGuna.UI2.dllD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000000.1864899967.00000000012E7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSPOOOFER.exeD vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1963235020.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SPOOOFER776.exe
Source: SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.Desktop.UI.dllH vs SPOOOFER776.exe
Source: SPOOOFER776.exe	Binary or memory string: OriginalFilenameSPOOOFER.exeD vs SPOOOFER776.exe

Source: SPOOOFER776.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: SPOOOFER776.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.0.SPOOOFER776.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/1@1/1

Source: C:\Users\user\Desktop\SPOOOFER776.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SPOOOFER776.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Mutant created: NULL

Source: SPOOOFER776.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SPOOOFER776.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SPOOOFER776.exe	Virustotal: Detection: 73%
Source: SPOOOFER776.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\SPOOOFER776.exe

File read: C:\Users\user\Desktop\SPOOOFER776.exe

Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SPOOOFER776.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SPOOOFER776.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SPOOOFER776.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SPOOOFER776.exe

Static file information: File size 5856768 > 1048576

Source: SPOOOFER776.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x554600

Source: SPOOOFER776.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SPOOOFER776.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Spoofer Valorant C#\Spoofer Valorant Atual\SpooferAtualizado\obj\Release\SPOOOFER.pdb source: SPOOOFER776.exe
Source:	Binary string: $iq.costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: costura.costura.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: Siticone.Desktop.UI.pdb source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Spoofer Valorant C#\Spoofer Valorant Atual\SpooferAtualizado\obj\Release\SPOOOFER.pdbBdU^dU PdU_CorExeMainmscoree.dll source: SPOOOFER776.exe
Source:	Binary string: guna.ui2?costura.guna.ui2.dll.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: Siticone.Desktop.UI.pdb8@N@ @@_CorDllMainmscoree.dll source: SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: SPOOOFER776.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: SPOOOFER776.exe
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: SPOOOFER776.exe

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: SPOOOFER776.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SPOOOFER776.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1864156282.0000000000F4D000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SPOOOFER776.exe PID: 6904, type: MEMORYSTR

Source: SPOOOFER776.exe

Static PE information: 0xF237E430 [Fri Oct 10 03:12:48 2098 UTC]

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0C247 push ecx; iretd	0_2_06B0C248
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_06B0C3BE push ebx; ret	0_2_06B0C3E5
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B319F7 push eax; retn 0070h	0_2_09B31A02
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A97 push eax; retn 0070h	0_2_09B31AA2
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A9C push eax; retn 0070h	0_2_09B31AA2
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A87 push eax; retn 0070h	0_2_09B31A92
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A3C push eax; retn 0070h	0_2_09B31A42
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A27 push eax; retn 0070h	0_2_09B31A32
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A17 push eax; retn 0070h	0_2_09B31A22
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A07 push eax; retn 0070h	0_2_09B31A12
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A6A push eax; retn 0070h	0_2_09B31A82
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A6C push eax; retn 0070h	0_2_09B31A72
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B31A47 push eax; retn 0070h	0_2_09B31A32
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B34CB8 push E805AF15h; iretd	0_2_09B34CBD
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B34363 push E805C65Eh; ret	0_2_09B34369
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Code function: 0_2_09B34340 push E806BD5Eh; retf	0_2_09B34361

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Memory allocated: 1C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Memory allocated: 35C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Memory allocated: 55C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Memory allocated: 6B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Memory allocated: 7B30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe TID: 5328	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe TID: 6020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe TID: 6984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SPOOOFER776.exe, 00000000.00000002.1974179062.0000000005FA7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Users\user\Desktop\SPOOOFER776.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SPOOOFER776.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SPOOOFER776.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SPOOOFER776.exe	74%	Virustotal		Browse
SPOOOFER776.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
SPOOOFER776.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://keyauth.wind	0%	Avira URL Cloud	safe
https://gunaui.com/api/licensing.phpLRiq	0%	Avira URL Cloud	safe
https://gunaui.com/LRiq	0%	Avira URL Cloud	safe
http://167.114.85.75/logo.zip	0%	Avira URL Cloud	safe
http://167.114.85.75/tpmbypassspoofer.exe	0%	Avira URL Cloud	safe
http://167.114.85.75/mac.bat	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/KeyAuthd	0%	Avira URL Cloud	safe
https://www.siticoneframework.com/Mhttps://siticoneframework.com/pricing/Mhttps://siticoneframework.	0%	Avira URL Cloud	safe
https://gunaui.com/pricing	0%	Avira URL Cloud	safe
https://gunaui.com/pricingLRiq(pf	0%	Avira URL Cloud	safe
https://gunaui.com/	0%	Avira URL Cloud	safe
https://payments.siticoneframework.com/api/licensing.php%Siticone	0%	Avira URL Cloud	safe
https://gunaui.com/api/licensing.php	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/KeyAuth	0%	Avira URL Cloud	safe
https://payments.siticoneframework.com/api/licensing.php	0%	Avira URL Cloud	safe
https://api.ipify.org)Nome	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.0/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org	SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://keyauth.win	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://keyauth.wind	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036FF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gunaui.com/api/licensing.phpLRiq	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/amifldrv64_1.sys	SPOOOFER776.exe	false		high
http://www.tiro.com	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gunaui.com/LRiq	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AFUWINx64.EXE	SPOOOFER776.exe	false		high
http://www.sajatypeworks.com	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://167.114.85.75/tpmbypassspoofer.exe	SPOOOFER776.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/logo.zip	SPOOOFER776.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/mac.bat	SPOOOFER776.exe	false	Avira URL Cloud: safe	unknown
https://www.siticoneframework.com/Mhttps://siticoneframework.com/pricing/Mhttps://siticoneframework.	SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gunaui.com/pricing	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gunaui.com/pricingLRiq(pf	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/KeyAuthd	SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/video/	SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gdata.youtube.com/feeds/api/videos/	SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://keyauth.win	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000036FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://payments.siticoneframework.com/api/licensing.php%Siticone	SPOOOFER776.exe, 00000000.00000002.1964529197.00000000047A2000.00000004.00000800.00020000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, SPOOOFER776.exe, 00000000.00000002.1964529197.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.0/aYou	SPOOOFER776.exe	false		high
https://keyauth.win/api/1.1/	SPOOOFER776.exe	false		high
http://www.carterandcone.coml	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1222693252319416370/7HHFXJ3XDvpPWnJrESXq2ra2rQYgEisxjWubp5mRiRjzLmM	SPOOOFER776.exe	false		high
http://www.founder.com.cn/cn	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AMIDEWINx64.exe	SPOOOFER776.exe	false		high
https://payments.siticoneframework.com/api/licensing.php	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/AMIFLDRV64.sys	SPOOOFER776.exe	false		high
http://www.jiyu-kobo.co.jp/	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	SPOOOFER776.exe, 00000000.00000002.1996226419.0000000009292000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Bronkzware/dsfgsgfgfgs/raw/refs/heads/main/Volumeid64.exe	SPOOOFER776.exe	false		high
https://gunaui.com/api/licensing.php	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/KeyAuth	SPOOOFER776.exe, 00000000.00000002.1963979501.0000000003728000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org)Nome	SPOOOFER776.exe	false	Avira URL Cloud: safe	unknown
https://gunaui.com/	SPOOOFER776.exe, 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590903
Start date and time:	2025-01-14 16:54:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SPOOOFER776.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 63 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	tpmbypassprivatestore.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	104.26.0.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	http://loginmicrosoftonline.al-mutaheda.com/expiration/notice/nRrRc/receiving@accel-inc.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	tpmbypassprivatestore.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	email.eml	Get hash	malicious	unknown	Browse	172.64.41.3
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	104.26.0.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.0.5
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.0.5
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.26.0.5

Process:	C:\Users\user\Desktop\SPOOOFER776.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1553
Entropy (8bit):	5.349053066873526
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HmHKJHKmTH3:Pq5qHwCYqh3oPtI6eqzxGqJqqX
MD5:	E7486FB6F704DFF43F9913929E0B6E90
SHA1:	8213ECDCA2A2902EA04CC46AD25B7BE8B009B66F
SHA-256:	4D21973286C22A3C68CC366BB1B73F2040212B6F4EDCC23D725EF141224DBE98
SHA-512:	345B6E69130DB544888D8E8F15BE7CB7604DE1F9EBAE9010CB62B9AA94EC1B74FBDE493D50DD0EE53C6DC2EE65961DC0887D7B860BF4525F50F54F907548E565
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.681946284740579
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SPOOOFER776.exe
File size:	5'856'768 bytes
MD5:	66a9fe0ffb298b4c4c390dee3bc534e9
SHA1:	5dc498039926c0c342c536d3cccf1e5c1dd752d8
SHA256:	0fc0de254bc80e54c708fbd0eb0460c730283508b94108e4b2d1d70525ef3fce
SHA512:	a8a8c2674744069531908b69384a1a03b38991ddbabd2a0d5908add292796e0ca4ed6c16a0867d1af0e200e4b203d6d1e41b6639ba6e6df276e43bbfc262ee36
SSDEEP:	98304:WDEBe6aA0c5ZUYKjYXC3UdKep9y1X+bEszBfhBVnTknrqkqXf0F9+KH4kpc+DX/P:W490cbzyEdKepwIb5zBXVnT02kSIEKYK
TLSH:	BF46F0422186D59CF037D9BC46D6E9ADF996AC615ED2C92A2DC3B5F880F32027B50F03
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.7..........."...0..FU.........ndU.. ........@.. ........................Y...........`................................

File Icon


Icon Hash:	4427131757593716

Static PE Info

General

Entrypoint:	0x95646e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF237E430 [Fri Oct 10 03:12:48 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x55641a	0x51	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x558000	0x4130c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x556338	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x554474	0x554600	5541e199cb4d52f020bf34a5a192525c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x558000	0x4130c	0x41400	d891dc917d538be924cb523af7b0577b	False	0.1685674090038314	data	3.375765933642511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x59a000	0xc	0x200	dabe037bf1c4ab067372e4781f14db8e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x558100	0x40c28	Device independent bitmap graphic, 251 x 512 x 32, image size 257024	0.16656362155804205
RT_GROUP_ICON	0x598d38	0x14	data	1.2
RT_VERSION	0x598d5c	0x3b0	data	0.4343220338983051
RT_MANIFEST	0x59911c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:56:12.365875006 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.365911961 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.365992069 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.378025055 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.378040075 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.844595909 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.847197056 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.850964069 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.850970984 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.851279974 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.893218040 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.903095007 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.947340965 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.997780085 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:12.998450994 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:12.998466969 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:13.114337921 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:13.114438057 CET	443	49738	104.26.0.5	192.168.2.4
Jan 14, 2025 16:56:13.114489079 CET	49738	443	192.168.2.4	104.26.0.5
Jan 14, 2025 16:56:13.117568970 CET	49738	443	192.168.2.4	104.26.0.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:56:12.346359968 CET	64491	53	192.168.2.4	1.1.1.1
Jan 14, 2025 16:56:12.359359980 CET	53	64491	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 16:56:12.346359968 CET	192.168.2.4	1.1.1.1	0x925b	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 16:56:12.359359980 CET	1.1.1.1	192.168.2.4	0x925b	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:56:12.359359980 CET	1.1.1.1	192.168.2.4	0x925b	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:56:12.359359980 CET	1.1.1.1	192.168.2.4	0x925b	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	104.26.0.5	443	6904	C:\Users\user\Desktop\SPOOOFER776.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 15:56:12 UTC	162	OUT	POST /api/1.0/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: keyauth.win Content-Length: 396 Expect: 100-continue Connection: Keep-Alive
2025-01-14 15:56:12 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-14 15:56:12 UTC	396	OUT	Data Raw: 74 79 70 65 3d 36 39 36 65 36 39 37 34 26 76 65 72 3d 36 63 39 30 30 63 34 62 62 32 61 65 34 33 31 30 64 32 31 34 30 65 61 36 37 32 63 37 33 33 35 65 26 68 61 73 68 3d 36 36 61 39 66 65 30 66 66 62 32 39 38 62 34 63 34 63 33 39 30 64 65 65 33 62 63 35 33 34 65 39 26 65 6e 63 6b 65 79 3d 66 32 34 61 34 66 64 35 35 62 66 38 66 63 61 30 62 31 65 38 36 31 31 34 35 66 61 32 30 34 39 38 35 63 64 64 62 33 30 36 64 32 65 37 61 61 39 62 33 61 61 65 30 61 35 34 38 62 37 66 61 66 63 31 61 61 64 33 39 36 37 30 34 62 65 38 65 31 66 35 64 62 34 39 63 39 37 37 62 34 63 37 64 36 65 32 30 35 33 36 39 32 35 36 39 61 38 35 38 35 63 66 65 65 32 38 61 36 33 35 61 66 38 32 65 36 38 64 37 30 62 30 61 31 66 30 35 34 39 32 64 39 65 64 32 36 63 35 61 30 30 66 63 32 62 31 66 33 36 Data Ascii: type=696e6974&ver=6c900c4bb2ae4310d2140ea672c7335e&hash=66a9fe0ffb298b4c4c390dee3bc534e9&enckey=f24a4fd55bf8fca0b1e861145fa204985cddb306d2e7aa9b3aae0a548b7fafc1aad396704be8e1f5db49c977b4c7d6e2053692569a8585cfee28a635af82e68d70b0a1f05492d9ed26c5a00fc2b1f36
2025-01-14 15:56:13 UTC	1369	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 15:56:13 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 192 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2BKuuP6wizOF0rAUoGaQ%2BiTXZsK0lb3dAvAycmAOl2jBd6ICVA16ovOB4z4bY%2Baj5m3STkpJ5mIhrbwHXl7Rf6htUF3racmm9Wnze%2Blszp%2FXaIp24hLnyZ7nNtm0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 901ed094fb411906-EWR server-timing: cfL4;desc="?proto=TCP&rtt=4362&min_rtt=1510&rtt_var=6129&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1194&delivery_rate=1906005&cwnd=253&unsent_bytes=0&cid=346a546c115b8c0c&ts=285&x=0" 3cfda93e77606f26eb75beba74fa06460b49566d59d0f46f
2025-01-14 15:56:13 UTC	144	IN	Data Raw: 33 30 61 30 63 63 30 34 61 37 39 30 30 31 32 39 39 65 33 34 66 39 36 65 62 35 37 30 31 36 35 37 37 31 37 65 64 64 36 30 61 62 33 32 38 36 35 66 33 36 62 66 64 32 64 33 32 61 63 32 37 32 33 63 37 35 64 31 63 39 66 30 64 37 30 63 34 37 61 64 35 65 32 39 66 39 64 38 34 39 30 62 33 38 39 63 61 32 63 39 37 66 35 30 61 62 64 31 61 30 33 34 66 64 37 35 63 34 36 37 62 30 36 39 30 33 66 35 61 35 61 39 35 31 33 34 34 64 35 63 33 34 33 33 Data Ascii: 30a0cc04a79001299e34f96eb5701657717edd60ab32865f36bfd2d32ac2723c75d1c9f0d70c47ad5e29f9d8490b389ca2c97f50abd1a034fd75c467b06903f5a5a951344d5c3433

Target ID:	0
Start time:	10:56:07
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\SPOOOFER776.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SPOOOFER776.exe"
Imagebase:	0xd50000
File size:	5'856'768 bytes
MD5 hash:	66A9FE0FFB298B4C4C390DEE3BC534E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1982188192.0000000007C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1864156282.0000000000F4D000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1974541992.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1963979501.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	99.7%
Signature Coverage:	0.8%
Total number of Nodes:	859
Total number of Limit Nodes:	66

Executed Functions

Function 06B07DC8 Relevance: 10.7, Strings: 8, Instructions: 716
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 06B081F5
\, xrefs: 06B08533
-, xrefs: 06B08586
,, xrefs: 06B08641
., xrefs: 06B0864B
W, xrefs: 06B081EB
", xrefs: 06B086B4
&, xrefs: 06B082B0

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: "$&$)$,$-$.$W$\
API String ID: 0-274362971
Opcode ID: 12551386e929bcf78720d7bdbf12c626914dcc2a34d3d2cc22eb0118205174d4
Instruction ID: 87a88b21e9b15a56310093a47fac75b7293ac3fd22a5ea8dad0c9197739d3fcb
Opcode Fuzzy Hash: 12551386e929bcf78720d7bdbf12c626914dcc2a34d3d2cc22eb0118205174d4
Instruction Fuzzy Hash: 98723534600A44CFDB55DB64C858EA9BBB2FF89301F1584E8E51A9B3B1DF31A986CF40

Function 06B07DD8 Relevance: 10.7, Strings: 8, Instructions: 713
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 06B081F5
\, xrefs: 06B08533
-, xrefs: 06B08586
,, xrefs: 06B08641
., xrefs: 06B0864B
W, xrefs: 06B081EB
", xrefs: 06B086B4
&, xrefs: 06B082B0

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: "$&$)$,$-$.$W$\
API String ID: 0-274362971
Opcode ID: 8dd80113dcfab7ff58af1fd4bc057157da64f66ae9c1c49d92660be68138f87d
Instruction ID: ba37704064d66020bdcf9c35d71827165cd45e537aa1cb6f81eff28b9613a6f3
Opcode Fuzzy Hash: 8dd80113dcfab7ff58af1fd4bc057157da64f66ae9c1c49d92660be68138f87d
Instruction Fuzzy Hash: 2F623634600A44CFDB55DB64C858EA9BBB2FF89301F1584E8E51A9B3B1DF31A986DF40

Function 06B07DD6 Relevance: 10.7, Strings: 8, Instructions: 712
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 06B081F5
\, xrefs: 06B08533
-, xrefs: 06B08586
,, xrefs: 06B08641
., xrefs: 06B0864B
W, xrefs: 06B081EB
", xrefs: 06B086B4
&, xrefs: 06B082B0

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: "$&$)$,$-$.$W$\
API String ID: 0-274362971
Opcode ID: 33d90715ff2edbf719f4400e97b1bf0bc15c841c0d4e1e6a44c6e91f0f6b7802
Instruction ID: 8dbf2c3be15fd5fa21aba220aaa0868c13473f21e405547fafaa5c9ae6434068
Opcode Fuzzy Hash: 33d90715ff2edbf719f4400e97b1bf0bc15c841c0d4e1e6a44c6e91f0f6b7802
Instruction Fuzzy Hash: F1624534600A44CFDB55DB64C858EA9BBB2FF89301F1584E8E51A9B3B1DF31A986CF40

Function 09219F90 Relevance: 2.9, Strings: 2, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hmq, xrefs: 0921A16D
Hmq, xrefs: 0921A1CD

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: Hmq$Hmq
API String ID: 0-2783791011
Opcode ID: 2a89e97e3612dda1507c0ff447f12d033462a03150267e2d786de91bbd212997
Instruction ID: 1babc8ce50b7fd793984e8fbaa220e190cbdd056d85bee0fb17dfb4cea8e732a
Opcode Fuzzy Hash: 2a89e97e3612dda1507c0ff447f12d033462a03150267e2d786de91bbd212997
Instruction Fuzzy Hash: 61E1A270A012589FCB05DFA9C994A9E7FF6FF99300F148069E409EB3A5DB309D46CB91

Function 09212A98 Relevance: 2.8, Strings: 2, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 09212B04
#, xrefs: 09212B9E

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: #$#
API String ID: 0-2529538431
Opcode ID: e0392493d0cb14b2320e3801799a4d62429d767b258d22df4b461cfeefd99102
Instruction ID: acd396c776e606f4a9fd845a612932b8e6a2f88bba3bc9cc178e1566e2017b39
Opcode Fuzzy Hash: e0392493d0cb14b2320e3801799a4d62429d767b258d22df4b461cfeefd99102
Instruction Fuzzy Hash: E5D1D635A10210CFDB04CF64C980B99BBB2FF94304F15817AD909AF366DBB6E946CB41

Function 09212AA8 Relevance: 2.8, Strings: 2, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 09212B04
#, xrefs: 09212B9E

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: #$#
API String ID: 0-2529538431
Opcode ID: 335129407d2d6e9d7fa094ffa7066054791a9dd27be550765dce151b20bef5f2
Instruction ID: c859ebb4276ceaa638e5b53a0b93352a5155f9e1a60a75ab7e2c12b961d5bb8a
Opcode Fuzzy Hash: 335129407d2d6e9d7fa094ffa7066054791a9dd27be550765dce151b20bef5f2
Instruction Fuzzy Hash: 91D1C531A10215CFDB04CF68C980B9ABBB6FF94304F158179D909AF3A5DBB6E946CB41

Function 06B0CDE3 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

#, xrefs: 06B0CE54

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 445d16890061b587ea50200da3534995025f194bd344215c5aa9b4e2ddce521f
Instruction ID: 3e959682bc7e0bd130fe1cbb8ef89457b3e70f3bdf7d99ff69bb77e3e953783d
Opcode Fuzzy Hash: 445d16890061b587ea50200da3534995025f194bd344215c5aa9b4e2ddce521f
Instruction Fuzzy Hash: B651E3B0911209DFEB40CF68D88479EFFB1FF88304F1496A9D404AB291D376D959CB91

Function 06B0E788 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec6d758693be7e07a5d7e614fcfdef3e0ec4edae95b28d90873a7536f6094ba
Instruction ID: 68229c06be84900434eb5fda7847c5f89ad846685abf9f1cccf80d6e6542aadc
Opcode Fuzzy Hash: dec6d758693be7e07a5d7e614fcfdef3e0ec4edae95b28d90873a7536f6094ba
Instruction Fuzzy Hash: B2B1C375B055019FE798DBB4CA80A6ABFB2FF88300F0184B6D6069B3E1DA75DC01CB81

Function 06B0E798 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a360bd45552219fa69f6ce34e969f7734890b48bf897a76cbaefd9ce8707a1
Instruction ID: 4e9b1f700b2bc915902fff1a11bed914e5e063e670caa63ae11680b5de1eeca7
Opcode Fuzzy Hash: c5a360bd45552219fa69f6ce34e969f7734890b48bf897a76cbaefd9ce8707a1
Instruction Fuzzy Hash: 62B1B275B055059FE798DBB4C980A6ABFB6FF88300F0084B6E6069B3E1DA75DC01CB81

Function 01C2E40C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9579bd56261ed894e580adeca4d87cdf9d1e6cb15094eef94ee069a164fd24e6
Instruction ID: 42f740eced9ba6f3567b2052b89cf9cd61b136cca34bcdc7ddc92dfb218a3285
Opcode Fuzzy Hash: 9579bd56261ed894e580adeca4d87cdf9d1e6cb15094eef94ee069a164fd24e6
Instruction Fuzzy Hash: CFA14D32A00229CFCF15DFB9C84499EBBB2FF95300B15456EE906BB265DB31E955CB80

Function 06B09908 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c93bc5192acd734247a50399dcc0489e4e1e0914fdd63699236e1bcc37108b
Instruction ID: f5e165306e776d536d2b5544f1dfaf8db0e3a0095e0ff6b52c3b14ffc7bb4898
Opcode Fuzzy Hash: 20c93bc5192acd734247a50399dcc0489e4e1e0914fdd63699236e1bcc37108b
Instruction Fuzzy Hash: 5E913BB4D40209EFEB48DFA1E58198DBFB2FF88310F10D46AD116AB2A5D734A905CF40

Function 06B09918 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f7dceda15c2eed426cf9bfc655160b4365cdfcf52ed94d7207ffd55cff22f7
Instruction ID: e34d2b3681c9e5da24bf45df4317d73f2d558e2dd72257d8c98c197eeb3fc9ad
Opcode Fuzzy Hash: a5f7dceda15c2eed426cf9bfc655160b4365cdfcf52ed94d7207ffd55cff22f7
Instruction Fuzzy Hash: 14911BB0D50609EFEB48DFA5E58198DBFF6FF88310F20D4669116AB2A5D734A905CF40

Function 0921D978 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cd932e64e599f3c96687cbf542cbdf5c46f077f3685d3da38929db86cacf04
Instruction ID: 1560374e663177f47d26a15f72784219f60ddd3fd3f00ef70e5a937602674a4a
Opcode Fuzzy Hash: d6cd932e64e599f3c96687cbf542cbdf5c46f077f3685d3da38929db86cacf04
Instruction Fuzzy Hash: 6751B332728212CFC708DE38C540726BBA6FBA0344B10997BD4458B2D0DB75EA65CB81

Function 0921CE94 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56800223dea02cbd756bd3ba7f66a742e283279e538ae0570a0fd991d39b3c1d
Instruction ID: 1fd95684cdcd9faa6334bab755e80e0e37b64149cdcf990c91c2080eb38894ae
Opcode Fuzzy Hash: 56800223dea02cbd756bd3ba7f66a742e283279e538ae0570a0fd991d39b3c1d
Instruction Fuzzy Hash: B951A132728216CFD708DE38958072ABBA6FBA0344F50997BD4468B2D4DB75E9A1C781

Function 06B0A239 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2adb7327ef2a630a4efc89a2c6128ffb8ffeafc4abc33422586b434e240ec1e
Instruction ID: 3310e33d0f938c48ea67094f9b55bdd8952ca3b82c82f7a678f15ce73ee8999c
Opcode Fuzzy Hash: d2adb7327ef2a630a4efc89a2c6128ffb8ffeafc4abc33422586b434e240ec1e
Instruction Fuzzy Hash: 9A5195B4A0420B8FEB41CF64C6C199EBFB1FB84310F108A7695049B2E6D775D989CBD1

Function 09B379A0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94fb2f3e43653773fa1720c82706357b994f0fe7409bb54f7ec4591c1712521
Instruction ID: 88aeed415540491815d4f6b5487ead10c0f07c7cfdd758dc7686a84997c824d0
Opcode Fuzzy Hash: c94fb2f3e43653773fa1720c82706357b994f0fe7409bb54f7ec4591c1712521
Instruction Fuzzy Hash: 9A419FB1B05206DFDB08DB74D894B6DB7A6FB84310F5085BAE1099B290DB35ED11CA91

Function 09B3799C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530abd92506ee00742e8528b1261e56e5052564c97d80691ac159b0f68b1f893
Instruction ID: 8a1e8014d0fe9417bb7376fba798402627dd8fc9d4397dedd6f8e31958124f85
Opcode Fuzzy Hash: 530abd92506ee00742e8528b1261e56e5052564c97d80691ac159b0f68b1f893
Instruction Fuzzy Hash: B241BDB1B05206DFDB08DF74C994B6DB7B6FB88310F5089BAE1099B290DB31AD11CB85

Function 01C2DB18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01C2DB96
GetCurrentThread.KERNEL32 ref: 01C2DBD3
GetCurrentProcess.KERNEL32 ref: 01C2DC10
GetCurrentThreadId.KERNEL32 ref: 01C2DC69

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c66aca2bf40fdffb814ce1682691766bd0260e9c4adb28a54e5ddffae8e11788
Instruction ID: 1309b5081a2f9332f73b23c865f4da6e79c780ad1e3d71e48a53693728f51ad9
Opcode Fuzzy Hash: c66aca2bf40fdffb814ce1682691766bd0260e9c4adb28a54e5ddffae8e11788
Instruction Fuzzy Hash: E85134B0900249CFDB14DFA9D548BEEBFF1AF88314F208459E419A7360DB74A985CF65

Function 09B34A35 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 09B34AED

Strings

Hmq, xrefs: 09B34D4B
Hmq, xrefs: 09B34D06

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: ActiveWindow
String ID: Hmq$Hmq
API String ID: 2558294473-2783791011
Opcode ID: 72a9bde8b278ebd577f2077ea972df316434e4d0b189914db85466f9a601e4a0
Instruction ID: ce6fe77a00de80dc8b146eebc346366c974d6b881dec0ec582001da16f42b980
Opcode Fuzzy Hash: 72a9bde8b278ebd577f2077ea972df316434e4d0b189914db85466f9a601e4a0
Instruction Fuzzy Hash: 4B61AF30F102199FCB49EFB894543AE7AE3FF98350F548468E506EB3A4DF3898468B55

Function 06B03CB8 Relevance: 2.0, APIs: 1, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aea24ee7309e5d13c2719211763448b327333d3ab890b678e87334dfe5e1134
Instruction ID: 59217ce1a7d3d6f1517506065e30733bc8bca216cff38407efede1b6340d5b05
Opcode Fuzzy Hash: 6aea24ee7309e5d13c2719211763448b327333d3ab890b678e87334dfe5e1134
Instruction Fuzzy Hash: 5A223FB4E00206CFFB94DB58D5889AEBFF2EB85310F2485D6DA11972E5DB349C81CB91

Function 01C2B770 Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01C2B9D6

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a1f20c90cae9c2ab478f670e9be322ba2e07ee01e8ea59c0b3cfcdb46ae6f8c5
Instruction ID: 87bfd287740e01ebdee9bd88d5185f5da4bb99b170bf5a1840b423edf1a22b7c
Opcode Fuzzy Hash: a1f20c90cae9c2ab478f670e9be322ba2e07ee01e8ea59c0b3cfcdb46ae6f8c5
Instruction Fuzzy Hash: 048142B0A00B15CFDB25DF2AD04075ABBF1BF88300F108A2AD48AD7B51DB74E949CB90

Function 07EA9C20 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,045C4144,03637F14,?,00000000), ref: 07EA9D8E

Memory Dump Source

Source File: 00000000.00000002.1985298813.0000000007EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ea0000_SPOOOFER776.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 05fc842c84a3663edbc0ab415f275f87bcba2702e9a0e917aceb7d9451348b4d
Instruction ID: 2cb5acf57ec4602889530abf68413501330f1d8abe2d015b18e354feac5e3ec5
Opcode Fuzzy Hash: 05fc842c84a3663edbc0ab415f275f87bcba2702e9a0e917aceb7d9451348b4d
Instruction Fuzzy Hash: E2718174A01209EFCB15DF69D888D9DBBB2BF49724F115498F911AB362D731E881CB50

Function 06B02324 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06B02442

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b505827ad7abcfe3ec47a49ab630c0ad4b7bed1f0d31133ebc1ee416d03115be
Instruction ID: 9ed0d04feb06763ee165c70a66ec10c1155ebf616bdaf7942b49b6c2aa73261b
Opcode Fuzzy Hash: b505827ad7abcfe3ec47a49ab630c0ad4b7bed1f0d31133ebc1ee416d03115be
Instruction Fuzzy Hash: 5C51EFB1C00209EFEF15CF99C984ADEBFB1BF48310F24816AE518AB261D7719945CF90

Function 06B02330 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06B02442

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 17d319b23a7f53aaaeaed7c3b5a7af5bc10310173b9a519d19ed22a138147f92
Instruction ID: de532cdecca7229e1fb36999fc97f86f1588791069421b4dbe32518f59fda48d
Opcode Fuzzy Hash: 17d319b23a7f53aaaeaed7c3b5a7af5bc10310173b9a519d19ed22a138147f92
Instruction Fuzzy Hash: 8541DFB1D00319AFEB14CF9AC884ADEBFB5FF48310F24816AE818AB250D7719945CF90

Function 06B00464 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06B049B1

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 90e67044b1d2e624b4c5ad042eb02b1fd1e6a97a33416a9e0b9c38e4f116d2e6
Instruction ID: 8c161a38bdfade363af0cc30fc1fe780a422f8a6dc9285e42bc0caa041fee7f4
Opcode Fuzzy Hash: 90e67044b1d2e624b4c5ad042eb02b1fd1e6a97a33416a9e0b9c38e4f116d2e6
Instruction Fuzzy Hash: 784129B4900305CFDB54CF99C548AAABFF5FB88314F24C599E559AB361D770A841CFA0

Function 01C24800 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01C26049

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 26cb30db56ba8a8c420147b9bb9bc80a0453051e8168d8080ac4356cb25497c5
Instruction ID: 20be4ac9474e6df6ee2db5f256f7c2651671c0f0bffcf349d035a201b7ee67ad
Opcode Fuzzy Hash: 26cb30db56ba8a8c420147b9bb9bc80a0453051e8168d8080ac4356cb25497c5
Instruction Fuzzy Hash: 0941C2B1C00729CFDB24DFA9C844B9EBBB5BF48304F24806AD508AB255DB756949CF90

Function 01C25F8D Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01C26049

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 502e9a94f9f8c1e3d3b107c287aba9dc0c35931ef647c1f59a85628a4cbe236b
Instruction ID: df92f4765a718129d245d4b3659016cb89184297c7cfa3ec562ff9b0c11054c4
Opcode Fuzzy Hash: 502e9a94f9f8c1e3d3b107c287aba9dc0c35931ef647c1f59a85628a4cbe236b
Instruction Fuzzy Hash: 0841D2B1C00729CFDB24CFA9C984BCEBBB5BF49304F24805AD408AB255DB756949CF94

Function 0921AF90 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?), ref: 0921B030

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a9531a6e02b27bc836302806274058654fdcd0e5f5fd55a172c433fa98f7735b
Instruction ID: 46c410b12b509387bcb2d8696d1ec08fc27b62b0e6879f3177755a4c6051762a
Opcode Fuzzy Hash: a9531a6e02b27bc836302806274058654fdcd0e5f5fd55a172c433fa98f7735b
Instruction Fuzzy Hash: 863114B1D11259DFCB10CFAAD884ADEFFF4AF58310F24802AE419E7250DB31A945CB90

Function 0921AF84 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?), ref: 0921B030

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6da475a4aa6a3fe25550e274a4d8cd1f0239490157c388684d4eeaef13a59412
Instruction ID: fe661b6a68003b05b1a9aae11c062d76fe0bb09be4966bef0f8399c0227e9f1a
Opcode Fuzzy Hash: 6da475a4aa6a3fe25550e274a4d8cd1f0239490157c388684d4eeaef13a59412
Instruction Fuzzy Hash: F63102B1D113599FDB14CFAAC884ADEBFF4AF58350F24802EE419E7250DB719985CBA0

Function 09B34EA0 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetProcessWindowStation.USER32 ref: 09B34EFD

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: ProcessStationWindow
String ID:
API String ID: 3348185895-0
Opcode ID: 9a2b93186c1609e5b4412ec62444f583a71eed4f37400927c6ccfe056f9cf524
Instruction ID: 5dc496c10440b9358e1886556506aa8ab7dd9d3972b8ee3eed3d5a95b40e1377
Opcode Fuzzy Hash: 9a2b93186c1609e5b4412ec62444f583a71eed4f37400927c6ccfe056f9cf524
Instruction Fuzzy Hash: 1021E470D002499FDB10CFA9C5487AEBFF9EB58320F18806AE409E7290D778A444CBE5

Function 09218A92 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 09218B2A

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c2fb58c87eca5dbf80beade9ecec4c77afae85a342b1f080c8290fcdff9c4a84
Instruction ID: 292f55d2989ab8106b12ef1a93ee4ddfd79e0360ac5e191e859a86053441570a
Opcode Fuzzy Hash: c2fb58c87eca5dbf80beade9ecec4c77afae85a342b1f080c8290fcdff9c4a84
Instruction Fuzzy Hash: A82157B69043498FDB10CF9AC844BDEBFF4EB49310F15C06AE458A7251D378A649CFA5

Function 09B34E9C Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetProcessWindowStation.USER32 ref: 09B34EFD

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: ProcessStationWindow
String ID:
API String ID: 3348185895-0
Opcode ID: 6e4812053ef4a8e1d5b9014ac05ad204567c97709da5c9189f78eade9b8b0fe9
Instruction ID: 526914e742d1fbe8956202c266e1f3391cf698182ca55443e86ed082370ea485
Opcode Fuzzy Hash: 6e4812053ef4a8e1d5b9014ac05ad204567c97709da5c9189f78eade9b8b0fe9
Instruction Fuzzy Hash: 9E21D371D002498FDB10CFA9C5447AEFBF5EB58320F58806AE419E7290D778A544CFA5

Function 09B35C68 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 09B35CF2

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6aec0d9033003202b973f6fa2a0b1b7e037854590bee6a87df1b322bbdddf90a
Instruction ID: 2922548783824203bb4256f56d518c924e29481f78e8f502e14b3b0d65a2ef2a
Opcode Fuzzy Hash: 6aec0d9033003202b973f6fa2a0b1b7e037854590bee6a87df1b322bbdddf90a
Instruction Fuzzy Hash: B12144B190024A8FCB10DF99C484A9EFBF0FB08324F10C56AE858AB311D374A945CFA1

Function 01C2DD60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01C2DDE7

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a349b660edb9993e988c72e0e04ae19ce1f5999f39ff27c58fec559cfa4fc6f1
Instruction ID: 92c5bba463fd0a19fc83710af9c8ff57fe1a8621f78ba885152715e3b2e71b12
Opcode Fuzzy Hash: a349b660edb9993e988c72e0e04ae19ce1f5999f39ff27c58fec559cfa4fc6f1
Instruction Fuzzy Hash: 2F21E4B5D00219DFDB10CF9AD984ADEBFF4EB48310F14801AE914A3310D374A940CFA5

Function 09B35D60 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09B35DD1

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 21dc5b0be137226a6ae319347d64f5f7bda7d1f42891e937752c9dc0845ae1c7
Instruction ID: 67990d9da739403911ba4ff23ad6c2e1f348c3039b95020e34e5e781ceb92e8c
Opcode Fuzzy Hash: 21dc5b0be137226a6ae319347d64f5f7bda7d1f42891e937752c9dc0845ae1c7
Instruction Fuzzy Hash: 772138B1D102198FDB10CF9AC844BEFFBF4EB88320F14842AE458A3250D774A944CFA4

Function 09B35D5C Relevance: 1.6, APIs: 1, Instructions: 58threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09B35DD1

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: b8138ba2b74d7d847abff5f3d5517d9e60fd9e734010d24b129ab038a7231ec2
Instruction ID: b860f2a0fe9b436fe58db16699a0914427d7191b421c88157610624db63826c0
Opcode Fuzzy Hash: b8138ba2b74d7d847abff5f3d5517d9e60fd9e734010d24b129ab038a7231ec2
Instruction Fuzzy Hash: 68212971D102198FDB14CF99C544BEEFBF5FB48320F14846AD458A7650C778A945CF64

Function 09B361A5 Relevance: 1.6, APIs: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 09B36225

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: c17f997bcf37c6c130668a2611f8eb895391adf343d5266a390c5a28701ec076
Instruction ID: 03c507cf63b101b44dbece47f46d4e08496a842ec2ffbefd873bc7fa1ed94cc7
Opcode Fuzzy Hash: c17f997bcf37c6c130668a2611f8eb895391adf343d5266a390c5a28701ec076
Instruction Fuzzy Hash: 3D21EFB6900359DFCB14CF9AD884ADEFBB4FB88320F10856EE419A7210C375A944CBA0

Function 0921F8B2 Relevance: 1.6, APIs: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,000000FF), ref: 0921F92F

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d08cfea3040c5aa9bf55376d460232a856effb839070f51d2e40fae3072f723e
Instruction ID: 1c5770c2d79778216b8e1b767b7d6370e6b7e61324df631c500c959ef80c4fcd
Opcode Fuzzy Hash: d08cfea3040c5aa9bf55376d460232a856effb839070f51d2e40fae3072f723e
Instruction Fuzzy Hash: EB21E2B5900319DFCB10CF9AD984ADEFBF8FB58310F10842AE558A7210D375A544CFA5

Function 09B361A8 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 09B36225

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 36b7840189b8a26b35de53d07b4e24f3dd3e221096c83a0be8102f87acce3cac
Instruction ID: 467673658d396c85123b99afb22374d4a462826d547054e9c9ccddb3fc68fb35
Opcode Fuzzy Hash: 36b7840189b8a26b35de53d07b4e24f3dd3e221096c83a0be8102f87acce3cac
Instruction Fuzzy Hash: 9D21EFB6900359DFCB14CF9AD884ADEFBB5FB48320F50856EE819A7200C375A944CBA4

Function 0921D214 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,000000FF), ref: 0921F92F

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a30643a4256430eddc4d51428855cc24e7b3c630edf63ee4c686adb910033e2
Instruction ID: c44dbdf89b656137539e0ad6b2e237beefaf32d43d6c1ee9029e111622838c6b
Opcode Fuzzy Hash: 5a30643a4256430eddc4d51428855cc24e7b3c630edf63ee4c686adb910033e2
Instruction Fuzzy Hash: 7321E2B5910319DFCB10DF9AD984ADEFBF4FB58310F50842AE958A7210D374A944CBA4

Function 09218AC0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 09218B2A

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8672d7f88b58b01b9f47a1843d9c79cfaf929cbf830ca1a18702f6cab024a573
Instruction ID: b4abb8e1285f67c523f6f794f3bed0f6b4c09492a9f9c4c0c6d02fb902378465
Opcode Fuzzy Hash: 8672d7f88b58b01b9f47a1843d9c79cfaf929cbf830ca1a18702f6cab024a573
Instruction Fuzzy Hash: E21126B6C002098FDB10CF9AC844BDEFBF4EB48320F10C02AE859A7240D378A645CFA5

Function 09960740 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 099607A5

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1ff0a3aa0f8919406a2d3047a41b2c9b85c50a1894652a3227c60dd684e5cb2e
Instruction ID: 6703408ec8d5ca44d2ec7401dfdbb526bc8894856e97eb42643705b289bb372e
Opcode Fuzzy Hash: 1ff0a3aa0f8919406a2d3047a41b2c9b85c50a1894652a3227c60dd684e5cb2e
Instruction Fuzzy Hash: BD1116B5800349DFDB10CF9AC885BEEBFF8EB48310F10845AE955A3251C378A684CFA1

Function 0921F2F0 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?,?,?,?,?,0921F2E1,?,?,00000000), ref: 0921F355

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2b155a67c8ce4f745ddd6b0c4e8083503bb1eef2d9514bd20b3e8922d146d3a7
Instruction ID: dfb5d093775d616cbacdad5454ef81e702fe57669e1994ad1900f3a49f73c8b0
Opcode Fuzzy Hash: 2b155a67c8ce4f745ddd6b0c4e8083503bb1eef2d9514bd20b3e8922d146d3a7
Instruction Fuzzy Hash: 42110FB5800348DFCB10CF9AC984BDEBBF8FB48324F10841AE468A7610C375A940CFA5

Function 09960748 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 099607A5

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0f29c535ba12b3cf8e661d9ee408b66e345b97aa12ab4fd1ec2e12480e339290
Instruction ID: 241566b4f5074342e6f247b2c344cffe36ceaa0e01caafd5147c5a035e9ddfb3
Opcode Fuzzy Hash: 0f29c535ba12b3cf8e661d9ee408b66e345b97aa12ab4fd1ec2e12480e339290
Instruction Fuzzy Hash: C91106B5800349DFDB10CF9AC885BDEFBF8EB48320F10845AE954A3650D379A584CFA5

Function 0921D178 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?,?,?,?,?,0921F2E1,?,?,00000000), ref: 0921F355

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 07c700d4b21c94161d42c37444975858c498300bfbd276843471deccae8813db
Instruction ID: 2f7055e29d8665d38b24d06da99ee9ce5e496dbf5e514a542b94717021120792
Opcode Fuzzy Hash: 07c700d4b21c94161d42c37444975858c498300bfbd276843471deccae8813db
Instruction Fuzzy Hash: 851103B5800749DFDB10DF9AC988BDEFBF8EB58320F108419E568A7610C3B5A954CFA5

Function 01C2B970 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01C2B9D6

Memory Dump Source

Source File: 00000000.00000002.1963684057.0000000001C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c20000_SPOOOFER776.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f988a48b6cd6b2b421feb2aa9f6588bb0c5a5fd6d46b1cce0f7981736d09aa0c
Instruction ID: 4759d226d283b55e0d74b5ba819d47a80e41873a2562a16809d732a8e9453d18
Opcode Fuzzy Hash: f988a48b6cd6b2b421feb2aa9f6588bb0c5a5fd6d46b1cce0f7981736d09aa0c
Instruction Fuzzy Hash: C5110FB5D00259CFDB10DF9AC444BDEFBF4AB88320F10842AD459A7210C375A945CFA1

Function 09964AE0 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01C96428,?,?), ref: 09965A7D

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a021489a94c011f19ee9604ca6f977b016fb56dc4740cae304899df586394372
Instruction ID: 966655fb2163f7ac56506f0c3a1e68e7bb4f0f2c986d6af909cd81bb7112b962
Opcode Fuzzy Hash: a021489a94c011f19ee9604ca6f977b016fb56dc4740cae304899df586394372
Instruction Fuzzy Hash: 4D11F2B5800349DFDB10DF9AC885BDEBBF8EB48320F10841AE959A7210C375A944CFA5

Function 09965A19 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01C96428,?,?), ref: 09965A7D

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 4264e4debf5970dfafc364294fe9f8b48ae8ab15187b30da1f3895859cdf7663
Instruction ID: 6a92d5e59b36ffd9f7f8db1a735aa65d3099d3232face2ff00a0a22a5280f0ba
Opcode Fuzzy Hash: 4264e4debf5970dfafc364294fe9f8b48ae8ab15187b30da1f3895859cdf7663
Instruction Fuzzy Hash: F611DFB58003499FDB10DF9AC885BDEBBF8EB48320F10845AE559A7220C375A944CFA1

Function 09215664 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 09215B4D

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 11e1381953e800dc338b92719cb0c3bdcc2bb8b7944b14003f7a354d6afd46af
Instruction ID: ba5bad5dc9da33bd7d5bb8e8e8d92aec871c44548fb4f242fcdf5241917ef624
Opcode Fuzzy Hash: 11e1381953e800dc338b92719cb0c3bdcc2bb8b7944b14003f7a354d6afd46af
Instruction Fuzzy Hash: 0C1130B18003098FCB20DF9AC488B9EBBF4EB48320F20845AE519A7210C374A980CFA4

Function 0921905A Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,09219049,?,?,00000000), ref: 092190BD

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f497738c81d7e69bc10891cca303472fd545197c0d0d29ae24cfa02844fe3f2e
Instruction ID: 5744c6490f6ef3ad8e55fe74d822ecf6430a4fa3a098560cfe8a409ddecd8e06
Opcode Fuzzy Hash: f497738c81d7e69bc10891cca303472fd545197c0d0d29ae24cfa02844fe3f2e
Instruction Fuzzy Hash: 4911F2B5800349CFDB10DF99D988BDFBBF4EB48324F10845AE558A7610C375A584CFA1

Function 09215AF0 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 09215B4D

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c75aa92b862ba4e1e9ea1f0fb6646639109ba6c50cded1b19a4f4093d2bf5538
Instruction ID: e760a55484674979e775726c099e8845f45866a73ec29630968d423ad94bde99
Opcode Fuzzy Hash: c75aa92b862ba4e1e9ea1f0fb6646639109ba6c50cded1b19a4f4093d2bf5538
Instruction Fuzzy Hash: 131132B1914349CFDB10DFA9D084BCEFFF0AB58324F24846AE119A7210C379A684CFA4

Function 0921708C Relevance: 1.5, APIs: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,09219049,?,?,00000000), ref: 092190BD

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5b4134df4e308cabd1bba2602a817d7febdaadcfcc49778332c975890ac176cd
Instruction ID: 99d46c2ee310b3e9d5477db307f5b9c3f524a7e8759d8f32d3d37deed4c608f4
Opcode Fuzzy Hash: 5b4134df4e308cabd1bba2602a817d7febdaadcfcc49778332c975890ac176cd
Instruction Fuzzy Hash: 430102B48003499FDB20DF9AC888B9FBFF8EB08310F108419E558A7210D3B5A980CFA5

Function 09960669 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 09960683

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 37bf02ecfeab6347f0586fd80fa8d70a5194e56c01bc7a047eac89398b298c9d
Instruction ID: 0eecfda27eb257197b95afe45e3c2c8342bad6e99c8cf3a36b320b8958b67b4b
Opcode Fuzzy Hash: 37bf02ecfeab6347f0586fd80fa8d70a5194e56c01bc7a047eac89398b298c9d
Instruction Fuzzy Hash: B7D0A9A640D3C00FC3024221992E1483F6098E302430A02CBC0968B133D80A881A9BA2

Function 018BD210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82d0f7090f1b4c9df775218a9aec65bc60aa7c5774a38e98475b88a44973242
Instruction ID: 84d3c9094f72337056fa9ff2c9a80eb440aca1a506ec8c45a4f09a01e1d22b63
Opcode Fuzzy Hash: c82d0f7090f1b4c9df775218a9aec65bc60aa7c5774a38e98475b88a44973242
Instruction Fuzzy Hash: F0217B71100280EFCB05DF84D9C0B57BF61FB88328F20C669E8088B346C336E416CBA1

Function 018CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962838208.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5ca25700e8e800836abc678964da97a5f48001e2720812f32cb2f8b0f1a182
Instruction ID: 20119832436407fdc6acfe7107aa57b5fc5fce265f1273bf64f7ba1626c41fdf
Opcode Fuzzy Hash: 9d5ca25700e8e800836abc678964da97a5f48001e2720812f32cb2f8b0f1a182
Instruction Fuzzy Hash: 43210071604204DFCB15EF58D9C4B26BBA5EB84B18F20C67DD80A8B256C33AD547CAA1

Function 018CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962838208.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9683c3fa2dfca5c14d5c7f5ce74459de1e7097e6699df7dd632f9bc4631a32b9
Instruction ID: 0ada80654312d75fa6e57fcb5be43a808c776ad0a0bebd83b5736a487feaf3be
Opcode Fuzzy Hash: 9683c3fa2dfca5c14d5c7f5ce74459de1e7097e6699df7dd632f9bc4631a32b9
Instruction Fuzzy Hash: 64213771504204DFDB01EF98D9C0B26BBA6FB84728F20C67DE8098B252C336E546CAA1

Function 018BD20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: fa3c78924e754f323976c0f9cca4f449205b851e7592572eca6ebfbf0e02c9f6
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 8021D276404280DFCB06CF44D9C4B56BF71FB84324F24C6A9DD084B256C336D51ACB91

Function 018CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962838208.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 89f7ffa05f564255b07f0210f9643e98a3cbcd8cb60a9c29a046c0072bb10caf
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: CC11BE75504240DFDB02DF54C5C4B15BF62FB84724F24C6AED8498B656C33AE40ACB91

Function 018CD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962838208.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a7f479fd8260b4b6c8fa89aeca40555210b8e2cddd4b2a457a7cdb97208c5035
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B311EB75504280CFCB02DF18D5C4B16BFA2FB84314F24C6AED8098B656C33AD40ACBA2

Function 018BD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301f79fe7c9d1d3b507ae03419f0e8bb893be54b08b1fcf16e6761c63c3ea9b6
Instruction ID: dd437d7d505cccf789560affafc0793301fd1b18ed989100ae61806cbfde1511
Opcode Fuzzy Hash: 301f79fe7c9d1d3b507ae03419f0e8bb893be54b08b1fcf16e6761c63c3ea9b6
Instruction Fuzzy Hash: 9001D071005384B9E7114A59CDC47E7FFD8DF41328F18C659ED098A346C379D540C675

Function 018BD6CF Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3332d355668ef227297cf88317b9d1dbca3586c1f7bbf6e9032fdeaf85920f19
Instruction ID: 954147e50c1440de68dd6bb297edaae6df05f205583e52be289ceb144d41809a
Opcode Fuzzy Hash: 3332d355668ef227297cf88317b9d1dbca3586c1f7bbf6e9032fdeaf85920f19
Instruction Fuzzy Hash: BBF0F976600604AF9724CF0ADC84C67FBADEBC4774715C5AAE84A8B712C671EC41CEA0

Function 018BD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32bb13b40b47b93f7cd4a86d75726b9efd94c192cc8dfe9b3b77bb71b574533
Instruction ID: 42d636a979c6341f200221ff2d3c7438881cbbad1f3e2647d577176b5b4ecb2d
Opcode Fuzzy Hash: e32bb13b40b47b93f7cd4a86d75726b9efd94c192cc8dfe9b3b77bb71b574533
Instruction Fuzzy Hash: A4F06271404384AEE7118A1ADCC4BA3FFE8EF51728F18C55AED084B386C2799844CAB1

Function 018BD6C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962796775.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4487a99c8f8da66a4c95a28b78fb9cd94287b9336a6a1ecc194b4b6cadc43123
Instruction ID: 7bd24232dba786ab020e5b9846c89467905f5c968bd3857817b196097c40faeb
Opcode Fuzzy Hash: 4487a99c8f8da66a4c95a28b78fb9cd94287b9336a6a1ecc194b4b6cadc43123
Instruction Fuzzy Hash: 46F03775104A80AFE325CF06CC84C63BFB9EB8576471A8589E85A8B352C671EC42CBA0

Non-executed Functions

Function 09964B3C Relevance: 6.9, Strings: 5, Instructions: 621COMMON

Download Yara Rule

Strings

Hmq, xrefs: 0996686D
Hmq, xrefs: 0996675C
Hmq, xrefs: 0996692B
Hmq, xrefs: 099667E3
Hmq, xrefs: 099666C9

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: Hmq$Hmq$Hmq$Hmq$Hmq
API String ID: 0-1314966066
Opcode ID: 7e4ad24e912d080c2f3453b4cd6c952da05a59a7cdff3a01aea86df847110640
Instruction ID: f0338aaeca1ef7b244fb36bec8e1cd31636be845e32e423ea1d3af3f086bd409
Opcode Fuzzy Hash: 7e4ad24e912d080c2f3453b4cd6c952da05a59a7cdff3a01aea86df847110640
Instruction Fuzzy Hash: 7932A030A00258CFDB54DFB9C8547AEBBF6BF88300F14856AD409AB3A9DA349D45CB95

Function 09963641 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

W, xrefs: 0996364D

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: c79a616d0d5fa2bdff1297b589c2acf7c47c0db02c85c7b7a3acfff82dc07d63
Instruction ID: 835e914830484ff9f7c152a20a6fa94e70b37bb7fbefdc09a8d02750486f7579
Opcode Fuzzy Hash: c79a616d0d5fa2bdff1297b589c2acf7c47c0db02c85c7b7a3acfff82dc07d63
Instruction Fuzzy Hash: E4D1F531C10B5ACECB11EB64D9906D9B7B1FF95300F50879AE5097B224EB70AAC9CF81

Function 06B09570 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

LRiq, xrefs: 06B09593

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: LRiq
API String ID: 0-209933059
Opcode ID: b4692dc6c2bfebfde4a49ef87071061e9982209d38d2aa74efcdae47698dc6ae
Instruction ID: 9b792b6de86158d03f2e5fcb054737b7acbca7a52fd27816ff2ddeafc9aa59c1
Opcode Fuzzy Hash: b4692dc6c2bfebfde4a49ef87071061e9982209d38d2aa74efcdae47698dc6ae
Instruction Fuzzy Hash: 9181B2B5E042198FFB44DA69C580BADBFB6EB84341F10A466E516EB3D1CA34DD418BC1

Function 06B09563 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

LRiq, xrefs: 06B09593

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: LRiq
API String ID: 0-209933059
Opcode ID: f171e6be5287cdb7e2f7d4e0b0f5fa3587c14671d1fe598ecc3ff48f399ec027
Instruction ID: 9d8d968cd936e1b95f4de274d99c58b8e6317cf3471d9dfcc0b805de69af7314
Opcode Fuzzy Hash: f171e6be5287cdb7e2f7d4e0b0f5fa3587c14671d1fe598ecc3ff48f399ec027
Instruction Fuzzy Hash: F681C4B5E04219CFFB84DA69C580BADBFB6AB84341F10E466D516EB3D1C634DD418BC1

Function 06B0BCF0 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

=, xrefs: 06B0BD28

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 1e1c5f1e4083fff3847fbb63c678aeb323beedd080e3537751fa4bb0b008aada
Instruction ID: 1ee7068b7b316287d74acdbff35aa894c4cf5d88577e47e63629a94cd0dc2a24
Opcode Fuzzy Hash: 1e1c5f1e4083fff3847fbb63c678aeb323beedd080e3537751fa4bb0b008aada
Instruction Fuzzy Hash: 4551E7B0A40745BFF794DB68CC41BBEBFB1EB84304F1484AAC216AF6D5D6789A44CB00

Function 06B0BD00 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

=, xrefs: 06B0BD28

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 26c798b3104aa7647f1a2b2231975bd5b26ea3b7af7cdf3258f2f5e2c0cf14e0
Instruction ID: 4471ee738bf9c790fb655e476eb5cd53579d354b5842f27cb6ce6a06a350144a
Opcode Fuzzy Hash: 26c798b3104aa7647f1a2b2231975bd5b26ea3b7af7cdf3258f2f5e2c0cf14e0
Instruction Fuzzy Hash: C651C8B0B40745BFF794DB68CC51B7EBEB2EB84304F14C4A9C216AB6C5D6749A44CB04

Function 06B0BD89 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

=, xrefs: 06B0BD28

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 056bc593bb51cd42b8444ec12fb3b1b3314721833e4badd6faa17ee0baf2e5b6
Instruction ID: 90381f080f07826941a16702f32e4babe94e8c1070a0d351e01e4b0b39085cac
Opcode Fuzzy Hash: 056bc593bb51cd42b8444ec12fb3b1b3314721833e4badd6faa17ee0baf2e5b6
Instruction Fuzzy Hash: EA41A6B0B40645BFF794DB64CC51B7EBEB2EBC4304F14C4AAC216AB6D5D6749A04CB04

Function 06B0BD5F Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

=, xrefs: 06B0BD28

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 46c38f613941677ccab18a1daff77f7d2e7714e09fd73b251d65292031704c53
Instruction ID: b9e6140df3809905825ca68bfffd0ec3500edb487cb3d47f19da58c37348e209
Opcode Fuzzy Hash: 46c38f613941677ccab18a1daff77f7d2e7714e09fd73b251d65292031704c53
Instruction Fuzzy Hash: A041A6B0B41645BFF794DB64CC51B7EBEB2EBC4304F24C4AAC216AB6D5D6789A04CB04

Function 06B0BE72 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

=, xrefs: 06B0BD28

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 77b7442435b4701a3fe7c390c85b8db2f1ad5d4fbcb071cf375efc638b245fad
Instruction ID: 7b67fcfe0882fe790e4fb08f3dd181775825835945e57f86a253540173e5b2f0
Opcode Fuzzy Hash: 77b7442435b4701a3fe7c390c85b8db2f1ad5d4fbcb071cf375efc638b245fad
Instruction Fuzzy Hash: 8E41C5B0A41645BFF794DB64CC51B7EBEB2EBC4304F14C4AAC216AB6D5C6749A04CB01

Function 09B39408 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000756729.0000000009B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b30000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3a09ac93900f02aadd402faf71baec1583e31b001693ae9d3af5978276068d
Instruction ID: 0cee02a09cdd1dd0554bea922549ea1b59727f836645645fcc541ae46c31cf58
Opcode Fuzzy Hash: 1f3a09ac93900f02aadd402faf71baec1583e31b001693ae9d3af5978276068d
Instruction Fuzzy Hash: D3D1BB71B01314CBDB25DF76C460BAA77EAAF88310F5485ADE146CB6A0DF75E801CB91

Function 06B00A90 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1b24a7170137754f59356b984f902a77aee469d4945ad571e06855739dff84
Instruction ID: bafacf01484144880be935462d1afa067ed387c1fee6ee40376205fcc8e9312a
Opcode Fuzzy Hash: 9e1b24a7170137754f59356b984f902a77aee469d4945ad571e06855739dff84
Instruction Fuzzy Hash: 3D1296F25017858AD332CF65EA4C3893BB1BB65318F50430AD2622B6E9DBB4954BCF45

Function 099660F8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564340a4080fbc80816b4a78dc973561b42b0619947a30de2f1582318a0756a9
Instruction ID: e05de98f7f747828092522a371a92316764ac0afb7bdd523b867cf84b062587e
Opcode Fuzzy Hash: 564340a4080fbc80816b4a78dc973561b42b0619947a30de2f1582318a0756a9
Instruction Fuzzy Hash: 97C13971E00258DFDF15CFA5C98079DBBB2AF88310F18C5AAE449AB265DB31E985CF50

Function 0996E9E4 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bf1a84cc27a039434f98ab710d397254a6648486f5faed4fc5cbb7a1f47cf0
Instruction ID: b4e0465384baf59338aee61e74f97c0cc3ea1aed3afaf93bb4c5306e8f5bed8b
Opcode Fuzzy Hash: d0bf1a84cc27a039434f98ab710d397254a6648486f5faed4fc5cbb7a1f47cf0
Instruction Fuzzy Hash: B7B1A071B042068FC784DF79D590259B6A5FFC5300B54C8BAC41ADF3AADB35E90ACB91

Function 0996F492 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8091bfd747fe2d01b350daa1d9d5fae358fd6a238784b5b216943bda7e51f084
Instruction ID: 7e6cbe2cbab89c12fd0d2c9c5d0ad713dfdd0fa7921c7c7951f202bf23a1e05d
Opcode Fuzzy Hash: 8091bfd747fe2d01b350daa1d9d5fae358fd6a238784b5b216943bda7e51f084
Instruction Fuzzy Hash: 0BB191317042068FC784DF79D590259B6A5FFC5300B54C8BAC41ADF3A9DB35E94ACB91

Function 09963650 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ec1b2be130f8b90abf37b98775ca4c0f5e79b12845d520380a78e3c495139
Instruction ID: 510570605e29dfe723edad4826b4b1231445ce7be63aa9d4d3cf60f200d041d2
Opcode Fuzzy Hash: 7c9ec1b2be130f8b90abf37b98775ca4c0f5e79b12845d520380a78e3c495139
Instruction Fuzzy Hash: 30D1C531C10B5ACECB10EB64D9906D9B7B1FFD5300F54979AE5097B224EB70AAC9CB81

Function 092120E0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786dde365e89a65c462a75de8c22de549c912e05906908d920c99cf83683e493
Instruction ID: ed1c6a0a04702b9d1fb5939b54ee6d26457ff949803dd4ca075728b6f830b2d7
Opcode Fuzzy Hash: 786dde365e89a65c462a75de8c22de549c912e05906908d920c99cf83683e493
Instruction Fuzzy Hash: 53A1F430718202DFCB48EF78D58124DB791EFA5300B50D87ADA1ADF35ACA35E965CB91

Function 0996EA64 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a455580c0f66359ccd77f483ea5810df59ca3c809d0f6b6b50651b82b39cdbc
Instruction ID: 720eab2087f4b5743d95d74d2cba3778b253956887966eb45a57d1031982dbec
Opcode Fuzzy Hash: 4a455580c0f66359ccd77f483ea5810df59ca3c809d0f6b6b50651b82b39cdbc
Instruction Fuzzy Hash: 4AA17F35A04109CFDB14CFA8E994B9DBBB6FB88340F198466E509EB365CB76DC52CB40

Function 09969679 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8216a857b39a56f47fea2b58e5856e5d71aea47737bda27ef099573241e6fc
Instruction ID: a447b03fdff60f75e37b511c37de9295337bbe877254a675e4de866426dd15ea
Opcode Fuzzy Hash: 5b8216a857b39a56f47fea2b58e5856e5d71aea47737bda27ef099573241e6fc
Instruction Fuzzy Hash: 27A13A70744305CFC745EF79859029ABBA2FFC5304B54C87E844ADF369DA32E90A8B95

Function 092120F0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9081c33511ff55d1418ef747020d2e469d61dae21a7aa172e6fde84488ed0
Instruction ID: 97f380708233fd1350e7e14f0cab27d0215b665307a8e31b5c01fed6c9a7cd40
Opcode Fuzzy Hash: cff9081c33511ff55d1418ef747020d2e469d61dae21a7aa172e6fde84488ed0
Instruction Fuzzy Hash: 89A1F530714202DFCB48EF38D58065DB691EFA5300B90D87ADA1EDF35ACA35E965CB91

Function 0996FAF1 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f022c5c30ede5e7ed40a91b958782702f3eefb98b4e1a3955ed3ab8503571a
Instruction ID: 0cfed9da2698d43c87fde6627d5c9ad1e11b02341377b927c6b2a66984eb6df5
Opcode Fuzzy Hash: 38f022c5c30ede5e7ed40a91b958782702f3eefb98b4e1a3955ed3ab8503571a
Instruction Fuzzy Hash: 89A16D35A04109CFDB14CFA8D994B9DBBB6EB88300F19846AE509EB375CB76DC52CB40

Function 09968A64 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8cf67d70d3fcbea075afe1c451d6be09be3669f9471cfc957ae334e18f8985
Instruction ID: f92945cd9aee0e7b09db00f585684c44fde9a9ecce84a18fc8240cf9297b1455
Opcode Fuzzy Hash: da8cf67d70d3fcbea075afe1c451d6be09be3669f9471cfc957ae334e18f8985
Instruction Fuzzy Hash: DAA15970744305CFC744EF79859069ABBA2FFC9304B54C87E850ADF369DA32E90A8B95

Function 06B00A80 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f103c1dd225753b22e1175cf89eef8bda8bfe8cb9bd99a4ab17a7fcdf9bdb59e
Instruction ID: 987cf7aac57874b6da05b5bf3572dec2298fc0b3d8dfb6ec472f9a512b0096c6
Opcode Fuzzy Hash: f103c1dd225753b22e1175cf89eef8bda8bfe8cb9bd99a4ab17a7fcdf9bdb59e
Instruction Fuzzy Hash: 72C11DB28017858FD722CF65EA4C3897BB1FBA5314F50430AD2626B2E8DBB4954BCF45

Function 0921E638 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990148306.0000000009210000.00000040.00000800.00020000.00000000.sdmp, Offset: 09210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9210000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b3f2875dafb7d42dde537e763584736f711b54214bc7faa59bbbff60f51e76
Instruction ID: 7baa4e1555de1fe483b776d5ce4e4ba415ffec22fa7211aeceddd168199c2981
Opcode Fuzzy Hash: c3b3f2875dafb7d42dde537e763584736f711b54214bc7faa59bbbff60f51e76
Instruction Fuzzy Hash: 91718E74E20658DBDB04CFA4C9846AEBBF6FF98700F15802AE809EB364E735C915CB45

Function 06B0DDA8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbbbd5ce28220577cb2dc6b5b9f47a903545a6f75a1f8a3e0fd313b809bbd4a
Instruction ID: 3578da47f84d01ec6c5f0b2577092b1610ead46e7f2d43605d94688417b84813
Opcode Fuzzy Hash: 3bbbbd5ce28220577cb2dc6b5b9f47a903545a6f75a1f8a3e0fd313b809bbd4a
Instruction Fuzzy Hash: 47515AB16145529FF3889AB8D98025A7F66FFC5300B414ABBC046CB6E4CE34D90A8BC1

Function 06B0A8F8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978301849.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b00000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5cf99b51648162d450c5495b26868f2a946757abdf68142c1b5c63a98e85b06
Instruction ID: 0bb3dff1e0668049055a82c1d61f48045a5ec76251d8de2af035bdd1c9b684b4
Opcode Fuzzy Hash: d5cf99b51648162d450c5495b26868f2a946757abdf68142c1b5c63a98e85b06
Instruction Fuzzy Hash: B14140B0E1060ADFEB44DF79D98055DBFF2FB88300F10D9A98016972A5E7389A49CF80

Function 0996E9B4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4aed7de5a8575f1b516aa1559bae050c5622585ec5a0f60c5e0235a48f2dd0
Instruction ID: ebbedc643dab2a9184cd7405348de640e743e42f5912ec8f5eaa6c1af492d50b
Opcode Fuzzy Hash: 7b4aed7de5a8575f1b516aa1559bae050c5622585ec5a0f60c5e0235a48f2dd0
Instruction Fuzzy Hash: 17012629B184414BE38CA63FED4462B564BA7C5360F4DC8BBA90ACB3F0CC34CC064A81

Function 0996F2D0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000549951.0000000009960000.00000040.00000800.00020000.00000000.sdmp, Offset: 09960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9960000_SPOOOFER776.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84c1808e4246fe670ad29c07cd8e1d3e685483bfae0381e8d8910d2cbb671bf
Instruction ID: eca34e0664454351fe39b0ec7bb9affab0dd2e3690d0993b9f5a284c3f2eba42
Opcode Fuzzy Hash: c84c1808e4246fe670ad29c07cd8e1d3e685483bfae0381e8d8910d2cbb671bf
Instruction Fuzzy Hash: 0401D439B185824EE34CAA3EA9447676A8767C5310F0DC8BF9D0ACB2F1CC35CC064B41

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SPOOOFER776.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SPOOOFER776.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
SPOOOFER776.exe

Function 06B07DC8 Relevance: 10.7, Strings: 8, Instructions: 716
COMMON

Function 06B07DD8 Relevance: 10.7, Strings: 8, Instructions: 713
COMMON

Function 06B07DD6 Relevance: 10.7, Strings: 8, Instructions: 712
COMMON

Function 09219F90 Relevance: 2.9, Strings: 2, Instructions: 374
COMMON

Function 09212A98 Relevance: 2.8, Strings: 2, Instructions: 321
COMMON

Function 09212AA8 Relevance: 2.8, Strings: 2, Instructions: 317
COMMON

Function 01C2DB18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 09B34A35 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199
COMMON