t�4����fKX��#�h`�>{��� ��8��0�A��@����*�T(��9�x��(���I��BL����48��YA�D %�WC� S�������@�4�ş��Z��]�#i^u! �zѦa\1�,��%��Iio�B���5f���H9rW���z_� �b��u�dGo���+ d��L���A�ŏ�Ɲ�V.�|mqȜNM*� "[Ԉ��D��1 �\�M�BV�/�Qo�۲���`��=�l�^ˡ��X�c�P���{3�~rf�Ԃ *�e�i�_*ۆ+w!ot\�ZΣZh}�}"�t:�ٯ�Y��8�B�ŜVFn�`�=���R�d�������һWh��^�N�^� z��!,i���B��Nj�uD6�2mu2�߮�@�%�qEsdO@�]>����~;^,���e�����G;��2?G?g/ �nb����@�h��T�ȈB��m�E�g�J �m Z�}5;]h|E����V��I"�my5��:Ϫ1�{&JQ��3�8=BL�����O!ʺ���m�u3l$Z����1�Ig�r���29�"�\ŧ�"mI�5��=���-_�N<W���C T�T� �����.�H݆q�kw�� ? � s�ؒ�����'��ϲRY�V�N�Q�Ȃ'��s{9\)�'��WH2�몤�f���^��/q%8�)�|t%�a��v��<AGA��~���*�}4(R�T`���ܔ��Am��V���Y[��bT�k�@���F���4�����T�����%B��*^�c?Ã�-Z��&a�&��)Ҝ��@�0OO~S�Y�7�g���װuK��Pqi�r����S��06�B���_��z�i�h]-������8�����x�h+>A[��h��=��P�.��B~DI����hq������4��R���S��)�#���jhf<p�s@,��+�+8 E�~Xi��DY�����'�%ILe ��kx��6��4 �%�ng�����7�9��y@2\UI?Z� ���"�?�-F|�d¾�_�֒'M���`[�[n�<aR�ZN�L�^n3V�e� P� So�S~��d�v�������g2����쳕N/��K|L~(��Z��2�d�!�:���O����6�2��l$F VhȐ<5�����|�L "���|`�AOu���ݲ��?��Y�����z��n������,�&9iŤ�7�� G��:�q�&T�c�������fq�"B�g;�`ᚎ!�`�F��kſ�r�� �p�Ta�u�K��6�N���AJ�V�%%̅)�w�|�[���~Z�� �� �=���4t�E�G�u)�Ռ���;Z����J}��`�;�u^����͊y%�'K�E>���H�E#ޟ�z87#��H5\��܌#n�9K��I4��7Gg\���gM䛵̹~`pt��������D�?��(P�g2f�����v� ��Z�YW7KJg)�_���"z$�<�Ʉ�[�O�j�m����O��*)�6���L���� Ή����{�B�Qtfh2#Y�t�����L,�"��paǕ��Fm��3���*fZ�}EG.�,�1��K��7M���]d��[*�\>=?=c�m=&�Zm\��k�2Ż�X���!DI0�W��,Q\U�;��]��x����Ч>d8�I$3�I�s�VrC�0�pb[���U�du�I'Tz�O���F��'�a�1TY�A��q@2�_g�8-�1Qk�*"�.���ۛ�eG��A�5EK����| �^���B��{�2�͕�RH��!l���ɼ�RY�L(�< ~����Cp ����c^�[W��� � '_��}�d��;���F�\Xӿ��QQ�C k�1�qH;��~Ӧ��J��ǘ�Z�/��*���@�T���9"�C;ȧr��i� @-��TBP`o�yv���qMq->�t�B����+�3�lܣ�d�2����L�jᯛ��.�F[HiQa*!H�XK[�`�w��2�u�̈lH���nɋ}*\�!���x��D��"�Wa�x�b�[�5�vZF?B��2G����bfA� *����R�[��X=IlX�q�� ���z0�8_Wbw�h��;DVFɨ�z��<�5(7�y,old���m��;�~$����å�b�iAW ��"�38��ǧI`��j�v��?�m;b��^h�Qӱ��Q(U�d�m�/,�.�#�(������^IE`D-e�qب@�\f�k��ƒ� �h�� >1Y�0 f7�b.�@,�/u��VL�P��C��:��QO �}�_%������=�������O�?��5��N�;�f����1�I��F�s6K�G@C$�m��[J�ֿ��$�s� %�������.�i%��5ĚQ��'�DY#�gU ;2��*q�#�[!m��xP�Gp�Y��5�����N�>�Nj��[~��6��`�����P����b�l��4�ҍ X"�K�~zm��U=��JVJ?V&T�wh�GW��La�j������ù��a�$�<�#<��ዀ�+�TX�Cir�2�=��/�?ė�P&�=�Ś�H�]�j�_��[k����V�$�V�*��H��[�g2y��Я�*4�~��y@��߮)�z�q���2��QL9��0���_ �����;ۮ�:�W_E���3���8���c��b�J�w';���ʂP�R3]x �t�Z��`$s��v$�ó(�$X710��Pe��?�{��I܋A%QY#�1��$mOfKţ�;� ~�+����g���+rtDt���6LD�)����Ċ3V�9ꌢ��Hs���k��LUN_O����3C�1`���i�qk�^�/f�J_[ 1nr�����4t � '/��OSRx~=F�!�|{�*���8�nXo���Rʅ��}�md��P����A�Z1=�0�>�x:��4^�=�K�Q��S�Y$l���:ײC<��� � �^f����^�{�����1>7�C�*y� �ަ��&��C*�uL{�Wӊ�#7;Fd�U-j������,�184R���_S���%�C't�� P~C�&��e�!#wL���M��ё��|
Static task
static1
Behavioral task
behavioral1
Sample
PassatHook.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PassatHook.exe
Resource
win10v2004-20240412-en
General
-
Target
PassatHook.exe
-
Size
6.5MB
-
MD5
3dcf545867bb1e191be4c5277aaf0ac1
-
SHA1
e07ba0f83f90915fa5f4d417faeeedb02c1c4787
-
SHA256
b6b7f227ba5cbeccf12d74ce9bc7cf86f758785d67cf491863acde41252c1fd4
-
SHA512
4bfcbaa2b4c5282d0fce2915893b06a986c4ca75100241daff154e0bff95e518c0640f99275cca497476bf47101d5c6fe1ffddb3b9444c358d8984fc18abe591
-
SSDEEP
98304:UIjmFq7YD421kVc/xng4MzB2nsa62XMECzXf1fVt/ty+Mje3SAcApLeZhWXhITQr:UqYD426m/xgnzQjnMlDL386f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PassatHook.exe
Files
-
PassatHook.exe.exe windows:6 windows x64 arch:x64
159df56b5e1e4d43f9b71fb692486679
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
msvcp140
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundA
imm32
ImmGetContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_fdsign
api-ms-win-crt-time-l1-1-0
_ctime64_s
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
advapi32
RegQueryValueExW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.staypas Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.staypas Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ