HackExternal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HackExternal.exe
Size 391KB
Sample231011-27ae4abb4t
SHA256 75426e672b3356ed98af0b336345f4acd3f2ddf32c2997372f7cf318d7097eee
MD5 26910d2402b7c193f43f5070f4c5583d
SHA1 e8834552c969bff5172c9b134a113585026cc32a
SHA512 b6691ddd594de66723eb82ebc071de4609a146723ba6a8fb206e0b43a845ff20746b8461711f552708636f3fcdfc39a82b99f3cfef3b9da7e6830c3e55ac4646
SSDEEP 12288:/SZvrw6MnQYqA1Bsci8weHKbH2nb2LMDb:/S5w6MnGcBs2xKbH2nywD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HackExternal.exe

File Explorer

HackExternal.exe

.exe 391KB

HackExternal.exe

IMPHASH 3b400b372c48b2480eeafc8f65893791
SHA256 75426e672b3356ed98af0b336345f4acd3f2ddf32c2997372f7cf318d7097eee
MD5 26910d2402b7c193f43f5070f4c5583d
SHA1 e8834552c969bff5172c9b134a113585026cc32a
SHA512 b6691ddd594de66723eb82ebc071de4609a146723ba6a8fb206e0b43a845ff20746b8461711f552708636f3fcdfc39a82b99f3cfef3b9da7e6830c3e55ac4646
SSDEEP 12288:/SZvrw6MnQYqA1Bsci8weHKbH2nb2LMDb:/S5w6MnGcBs2xKbH2nywD
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep CreateThread CreateToolhelp32Snapshot InitializeSListHead GetSystemTimeAsFileTime CreateFileW lstrcmpiA IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection MultiByteToWideChar CloseHandle GetCurrentProcessId Process32Next DeviceIoControl GetCurrentThreadId Process32First

user32

GetWindow DispatchMessageA GetWindowRect DestroyWindow SetWindowPos ShowWindow GetCapture SetWindowLongA GetForegroundWindow DefWindowProcA CreateWindowExA TranslateMessage mouse_event LoadIconA GetAsyncKeyState ClientToScreen SetCapture SetCursor RegisterClassExA UpdateWindow PeekMessageA UnregisterClassA PostQuitMessage FindWindowA GetKeyState LoadCursorA GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard GetActiveWindow EmptyClipboard GetClipboardData SetClipboardData ScreenToClient

shell32

ShellExecuteA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3d9

Direct3DCreate9Ex

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_terminate memmove memcpy memcmp memchr _CxxThrowException memset strstr __current_exception_context __current_exception __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fflush __acrt_iob_func _get_stream_buffer_pointers ftell fsetpos ungetc fseek setvbuf fgetpos __p__commode _set_fmode __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s fwrite _wfopen fputc fclose __stdio_common_vsprintf __stdio_common_vsscanf fread _fseeki64

api-ms-win-crt-string-l1-1-0

strncpy strcmp

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol strtof atof

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _get_initial_narrow_environment _initterm _initterm_e _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _errno _invalid_parameter_noinfo_noreturn terminate _initialize_onexit_table _initialize_narrow_environment exit _configure_narrow_argv _cexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

fmodf tanf cosf acosf powf sinf ceilf sqrtf __setusermatherr atan2f

api-ms-win-crt-locale-l1-1-0

_configthreadlocale