Behavioral task
behavioral1
Sample
Hawkish-Eyes-main.zip
Resource
win10v2004-20230220-en
General
-
Target
Hawkish-Eyes-main.zip
-
Size
1.0MB
-
MD5
f648067a669c8a4f5a9a7db65c96b193
-
SHA1
378309f184300798ada863451cf9f4bb2e5e94b3
-
SHA256
d564119b2694017fdd615e860e14a100b1281bc45f5c017206015ca366043702
-
SHA512
97a3862b77bea42ef8a480ed5b723083fd19abe66c583905a8390f172d92fa3d80e0f375a5bd61f6dea40377704f032bb88d7bd2f5f7837ac6430610441918de
-
SSDEEP
24576:ASpKjWY6cOb0vnnPH1M5q8fvTbkrqAItD6b6D8J7kw5m:tKZlM5ZMr8D8YCm
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/Hawkish-Eyes-main/Hawkish_assets/upx/upx.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hawkish-Eyes-main/Hawkish_assets/upx/upx.exe unpack002/out.upx
Files
-
Hawkish-Eyes-main.zip.zip
-
Hawkish-Eyes-main/Hawkish_assets/img/about_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/about_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/arrow_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/arrow_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/build_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/build_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/crypto_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/crypto_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/files_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/files_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/hawkish.ico
-
Hawkish-Eyes-main/Hawkish_assets/img/logo.ico
-
Hawkish-Eyes-main/Hawkish_assets/img/logo.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/options_d.png.png
-
Hawkish-Eyes-main/Hawkish_assets/img/options_w.png.png
-
Hawkish-Eyes-main/Hawkish_assets/upx/upx.exe.exe windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 522KB - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 850KB - Virtual size: 849KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Hawkish-Eyes-main/Hawkish_assets/version/version.txt
-
Hawkish-Eyes-main/LICENSE
-
Hawkish-Eyes-main/README.md
-
Hawkish-Eyes-main/builder.py
-
Hawkish-Eyes-main/install.bat
-
Hawkish-Eyes-main/main.py.py .ps1
-
Hawkish-Eyes-main/obfuscation.py
-
Hawkish-Eyes-main/requirements.txt
-
Hawkish-Eyes-main/start.bat