Static task
static1
Behavioral task
behavioral1
Sample
hollows_hunter64.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
hollows_hunter64.exe
Resource
win10v2004-20230221-en
General
-
Target
hollows_hunter64.exe
-
Size
1.0MB
-
MD5
6b7b811c1b17b595ec70410b3c617965
-
SHA1
de1f310c6292ba8b867338bdfe6cc63ee2929dfd
-
SHA256
b7117f3e7f8b921914c8e0c9649560067a17343369cd581db75b1145ad581bb9
-
SHA512
e9626919fea2b742993459dd485d3a239281bc02e649fe2db9c79938dd1f5c4445a6f8aa1611ad19efc8e291b26f6e5cf60cc3c4be3de9667df1d743b5a0c025
-
SSDEEP
24576:qU+Wiy7hR38c7xCcHlbk7ZumU63CSLKycn:qYz38c7xCcHBGumVNcn
Malware Config
Signatures
Files
-
hollows_hunter64.exe.exe windows x64
a8274c92442bf6327cd5c76c92468e9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
psapi
GetModuleFileNameExA
GetProcessImageFileNameA
GetMappedFileNameA
EnumProcessModulesEx
QueryWorkingSet
ntdll
NtCreateFile
ZwQueryInformationFile
NtQuerySystemInformation
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureContext
shlwapi
PathCanonicalizeA
kernel32
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
FlushConsoleInputBuffer
GetProcAddress
GetModuleHandleA
CloseHandle
OpenProcess
GetCurrentProcess
TerminateProcess
Process32Next
Process32First
GetLastError
CreateToolhelp32Snapshot
GetTickCount
GetCurrentProcessId
GetCurrentThread
GetProcessTimes
IsBadWritePtr
SetLastError
LoadLibraryA
FreeLibrary
CreateFileA
ExpandEnvironmentStringsA
QueryDosDeviceA
GetLogicalDrives
GetCurrentDirectoryA
GetLongPathNameA
IsValidLocale
GetProcessId
WaitForSingleObject
CreateThread
IsBadReadPtr
GetFileAttributesA
GetWindowsDirectoryA
GetFullPathNameA
CreateDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualQueryEx
GetThreadContext
Wow64GetThreadContext
GetExitCodeThread
OpenThread
Thread32Next
Thread32First
GetTickCount64
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
WriteFile
ReadFile
VirtualAlloc
VirtualFree
ReadProcessMemory
VirtualProtectEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
CreateFileW
SetEndOfFile
GetProcessHeap
TerminateThread
GetModuleFileNameA
GetTimeZoneInformation
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
Sleep
EncodePointer
DecodePointer
GetLocaleInfoW
HeapFree
RaiseException
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetCommandLineA
GetCPInfo
HeapAlloc
LCMapStringW
CompareStringW
HeapSetInformation
GetVersion
HeapCreate
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleHandleW
advapi32
ImpersonateSelf
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenThreadToken
LookupPrivilegeValueA
AdjustTokenPrivileges
dbghelp
SymInitialize
SymCleanup
StackWalk64
SymGetModuleBase64
SymFunctionTableAccess64
Sections
.text Size: 658KB - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: 1024B - Virtual size: 798B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ