Static task
static1
Behavioral task
behavioral1
Sample
PassatHook.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PassatHook.exe
Resource
win10v2004-20240419-en
General
-
Target
PassatHook.exe
-
Size
13.6MB
-
MD5
b5d154185dbfc9467a65769436f0581c
-
SHA1
8af9e9f3b939931f75d234e57372e123f70f6fb9
-
SHA256
682ddaa6934baa9cccccb5f8c32b3a0843ba9d24d02f68bd4b4d051cba84094c
-
SHA512
fe8a816feb650c0c4f5261da3cbe3dd4aea2f0dd44c8180b2e7ac699a43b6053b901d01ce82b96b18b06c668bfa395f65eeeea16f22ee8e3ee7f9f17fde68cdf
-
SSDEEP
393216:/+rquBh/eWcIu8uTGzBkYFWMGCVZ7E54:/+OcNV5fuTixl/45
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PassatHook.exe
Files
-
PassatHook.exe.exe windows:6 windows x64 arch:x64
59fb6dce61733a515aeb6066fc4dad13
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
msvcp140
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundA
imm32
ImmGetContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_fdclass
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
rand
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.staypas Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.staypas Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.staypas Size: 13.6MB - Virtual size: 13.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ