Psycho Hatsher tool[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Psycho Hatsher tool.zip
Size

6.3MB
MD5

00e18cb05959b63de5fe8364096ee504
SHA1

27af2df965fd4edf50f84320b535fec539731152
SHA256

bd9d86d95d1c4c36409a53d72d42a55e64081c4e28e3b5821b5aad6c8688b6c2
SHA512

461b7c9af31870e5907a536fcf3a1f39802c44bd98b8ea4151b4a6ec013be4276b896d7145287c1cd4b5f601f2b889364211f78d021f90c507f925b5ce4c5ee4
SSDEEP

196608:oTwIEuhDqRW/CxKo6EAok+DJNIR1/OFfb:oTwIBqRWyKrE/lI1/O1b

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Psycho Hatsher tool/32autohotkey.dll
unpack001/Psycho Hatsher tool/Psycho Hatcher Tool.exe

Files

Psycho Hatsher tool.zip
.zip
Psycho Hatsher tool/32autohotkey.dll
.dll regsvr32 windows:5 windows x86 arch:x86

eef4c1fee903b2246d43be69a0d2a291

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

gethostbyaddr
getservbyport
ntohs
htonl
getservbyname
htons
WSAGetLastError
inet_addr
gethostbyname
ioctlsocket
WSASetLastError
recv
gethostname
WSACleanup
closesocket
connect
socket
WSAStartup
send

winmm

mixerClose
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetDevCapsA
waveOutSetVolume
joyGetDevCapsA
mixerOpen
mciSendStringA
mixerGetLineInfoA
waveOutGetVolume
joyGetPosEx

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

comctl32

ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
ord6
ord17

shlwapi

PathFindExtensionA

psapi

GetModuleBaseNameA
GetModuleFileNameExA

kernel32

GetEnvironmentVariableA
GetCPInfo
MultiByteToWideChar
lstrlenW
CloseHandle
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
FindResourceA
GetExitCodeThread
InitializeCriticalSection
GetCurrentDirectoryA
TerminateThread
lstrcmpiA
CreateThread
SetThreadPriority
CreateMutexA
GetLastError
CreateFileA
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
WriteFile
ActivateActCtx
CreateActCtxA
DeactivateActCtx
VirtualAlloc
VirtualProtect
GetTempPathA
GetVersionExA
lstrlenA
lstrcpyA
DeleteCriticalSection
GetFileAttributesA
OpenProcess
GetCurrentProcessId
GetFullPathNameA
MulDiv
GetSystemTimeAsFileTime
SizeofResource
LoadResource
LockResource
FindFirstFileA
FindNextFileA
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableA
Beep
GetCurrentThreadId
CreateProcessA
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
TerminateProcess
SetPriorityClass
SetLastError
GetLocalTime
GetDateFormatA
GetTimeFormatA
SetErrorMode
GetDiskFreeSpaceA
SetVolumeLabelA
DeviceIoControl
GetDriveTypeA
GetVolumeInformationA
CreateDirectoryA
ReadFile
GetACP
GlobalSize
DeleteFileA
CopyFileA
SetFileAttributesA
LocalFileTimeToFileTime
SetFileTime
GetSystemTime
GetComputerNameA
GetWindowsDirectoryA
GetShortPathNameA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryDosDeviceA
CompareStringA
RemoveDirectoryA
GetCurrentProcess
FormatMessageA
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
WritePrivateProfileSectionA
SetEndOfFile
GetFileType
SetFilePointerEx
GetFileSizeEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesA
LoadLibraryExA
OutputDebugStringA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
SetCurrentDirectoryA
Sleep
GetTickCount
TlsFree
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetStringTypeW
HeapReAlloc
ExitThread
GetModuleHandleW
ExitProcess
HeapSize
HeapQueryInformation
GetCommandLineA
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetFilePointer
SetHandleCount
GetStartupInfoW
LoadLibraryW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
MoveFileA
VirtualQuery

user32

GetDlgItem
SetDlgItemTextA
MessageBeep
EnumClipboardFormats
GetCaretPos
ClientToScreen
GetCursor
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringA
IsWindowEnabled
ExitWindowsEx
SetMenu
FlashWindow
MapWindowPoints
RedrawWindow
SetParent
UpdateWindow
GetMessagePos
GetClassLongA
DefDlgProcA
CallWindowProcA
CheckRadioButton
IntersectRect
PtInRect
CreateAcceleratorTableA
DestroyAcceleratorTable
AppendMenuA
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoA
IsMenu
CreateMenu
CreatePopupMenu
SetMenuInfo
DestroyMenu
TrackPopupMenuEx
CreateIconIndirect
GetDesktopWindow
CopyImage
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
GetWindow
BringWindowToTop
GetTopWindow
MoveWindow
GetQueueStatus
GetWindowRect
GetClientRect
SystemParametersInfoA
AdjustWindowRectEx
DrawTextA
SetRect
GetIconInfo
SetWindowTextA
IsWindowVisible
GetMenu
CheckMenuItem
EnableMenuItem
SetClipboardViewer
LoadAcceleratorsA
ReleaseDC
GetDC
CreateWindowExA
RegisterClassExA
LoadCursorA
SendDlgItemMessageA
ChangeClipboardChain
DestroyIcon
DestroyWindow
IsCharAlphaA
CharNextW
MapVirtualKeyA
VkKeyScanExA
GetWindowTextA
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
PostMessageW
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
UnhookWindowsHookEx
SetWindowsHookExA
PostThreadMessageA
IsCharUpperA
IsCharLowerA
IsCharAlphaNumericA
ToAsciiEx
FindWindowA
GetKeyboardLayout
CallNextHookEx
CharLowerA
PostMessageA
SendMessageTimeoutA
DialogBoxParamA
SetForegroundWindow
DefWindowProcA
FillRect
DrawIconEx
GetSysColorBrush
GetSysColor
IsIconic
IsZoomed
EnumWindows
GetWindowTextLengthA
EnableWindow
InvalidateRect
SetWindowPos
UnregisterClassA
MessageBoxA
OpenClipboard
GetClipboardData
GetClipboardFormatNameA
CloseClipboard
SetClipboardData
EmptyClipboard
EndDialog
IsWindow
DispatchMessageA
TranslateMessage
RegisterWindowMessageA
ShowWindow
CountClipboardFormats
SetWindowLongA
ScreenToClient
IsDialogMessageA
SendMessageA
GetWindowLongA
GetKeyState
TranslateAcceleratorA
KillTimer
PeekMessageA
GetFocus
GetClassNameA
GetWindowThreadProcessId
GetForegroundWindow
GetMessageA
SetTimer
GetParent
GetDlgCtrlID
CharUpperA
IsClipboardFormatAvailable
SetWindowRgn
SetFocus
SetActiveWindow
LoadImageA
EnumChildWindows
RegisterHotKey

gdi32

ExcludeClipRect
SetTextColor
GetClipRgn
GetPixel
BitBlt
EnumFontFamiliesExA
FillRgn
GetClipBox
SetBkColor
SetBkMode
GdiFlush
DeleteObject
CreateFontA
GetDeviceCaps
CreateSolidBrush
CreateDCA
GetStockObject
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectA
GetTextMetricsA
GetTextFaceA
SelectObject
CreateDIBSection

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetOpenFileNameA

advapi32

OpenProcessToken
RegDeleteValueA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
CloseServiceHandle
UnlockServiceDatabase
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegSetValueExA
LockServiceDatabase
RegConnectRegistryA
RegQueryInfoKeyA
RegEnumValueA
GetUserNameA
OpenSCManagerA

shell32

SHBrowseForFolderA
ExtractIconA
DragQueryPoint
SHFileOperationA
SHGetPathFromIDListA
DragQueryFileA
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathA
ShellExecuteExA
Shell_NotifyIconA
CommandLineToArgvW
DragFinish

ole32

OleInitialize
CoTaskMemFree
StringFromCLSID
OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

VariantInit
VariantCopy
LoadRegTypeLi
DispGetIDsOfNames
DispInvoke
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
VariantChangeType
SafeArrayCopy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayGetElemsize
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
OleLoadPicture

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
addFile
addScript
ahkExec
ahkExecuteLine
ahkFindFunc
ahkFindLabel
ahkFunction
ahkLabel
ahkPause
ahkPostFunction
ahkReady
ahkReload
ahkTerminate
ahkassign
ahkdll
ahkgetvar
ahktextdll
com_ahkReady
com_ahkTerminate
ximportfunc

Sections

.text
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Psycho Hatsher tool/AutoItX3.dll
.dll regsvr32 windows:5 windows x86 arch:x86

296f11054858cd5d0f4e0a5ca0f1a6d3

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:f3:48:6e:1d:d8:a9:10:30:34:a0:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

04/05/2020, 08:39

Not After

04/08/2023, 06:50

Subject

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:5a:1e:9a:43:15:da:16:7a:03:db:d7:0d:f5:b5:21:63:8d:23:3a:26:b0:2c:76:26:ad:40:c2:6c:7a:77:e5
Signer

Actual PE Digest

4a:5a:1e:9a:43:15:da:16:7a:03:db:d7:0d:f5:b5:21:63:8d:23:3a:26:b0:2c:76:26:ad:40:c2:6c:7a:77:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Data\svn\autoit\branch_3.3.16\bin\AutoItX\AutoItX3.pdb

Imports

mpr

WNetCancelConnection2W
WNetGetConnectionW
WNetUseConnectionW

winmm

mciSendStringW
timeGetTime

comctl32

ord17

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wsock32

gethostname
WSAStartup
gethostbyname
inet_addr
WSACleanup

userenv

LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock

kernel32

CreateFileW
InterlockedExchange
TerminateThread
ReadFile
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetThreadLocale
SetThreadLocale
DecodePointer
EncodePointer
Sleep
GetCurrentThreadId
GetVersionExW
IsWow64Process
GetSystemInfo
LoadLibraryA
FormatMessageW
GlobalLock
GlobalUnlock
GlobalAlloc
OpenProcess
TerminateProcess
GetSystemDirectoryW
GetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
SetPriorityClass
QueryPerformanceCounter
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
lstrlenW
GetFileAttributesW
FindFirstFileW
FindClose
GetFullPathNameW
GetStdHandle
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
WideCharToMultiByte
GetLocalTime
WriteFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetFileType
HeapReAlloc
HeapSize
GetACP
GetStringTypeW
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapFree
GetProcessHeap
HeapAlloc
WaitForSingleObject
CreateThread
DuplicateHandle
GetCurrentProcess
GetCurrentThread
CloseHandle
GetLastError
CompareStringA
CompareStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreatePipe
SetEnvironmentVariableW
SetConsoleCtrlHandler
SetFilePointerEx
WriteConsoleW
GetLongPathNameW
OutputDebugStringA

user32

IsClipboardFormatAvailable
GetClipboardData
CountClipboardFormats
DestroyWindow
OpenClipboard
GetUserObjectSecurity
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
OpenDesktopW
CloseWindowStation
EmptyClipboard
SetClipboardData
GetDC
ReleaseDC
GetCursorPos
mouse_event
LoadCursorW
WindowFromPoint
GetCursor
ClientToScreen
SetWindowPos
GetMenu
GetMenuItemCount
GetMenuStringW
GetMenuItemID
GetSubMenu
GetClientRect
GetCaretPos
IsIconic
IsZoomed
CreateWindowExW
MessageBoxW
MonitorFromPoint
CopyRect
FindWindowW
SetWindowLongW
SetLayeredWindowAttributes
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
SendInput
keybd_event
SystemParametersInfoW
SetForegroundWindow
UnregisterClassW
LoadStringW
MonitorFromRect
ExitWindowsEx
EndDialog
SetActiveWindow
FindWindowExW
EnumThreadWindows
CloseClipboard
EnumWindows
GetDesktopWindow
IsWindow
GetForegroundWindow
IsWindowEnabled
IsWindowVisible
ShowWindow
EnableWindow
MoveWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
RegisterWindowMessageW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetFocus
CharLowerBuffW
CharNextW
CharUpperBuffW
SetUserObjectSecurity
CloseDesktop
GetMonitorInfoW

gdi32

GetDIBits
GetDeviceCaps
GetTextExtentPoint32W
GetPixel
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
DeleteObject

advapi32

LogonUserW
InitiateSystemShutdownExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
SetSecurityDescriptorDacl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
GetAce
AddAce
RegDeleteKeyW

shell32

SHFileOperationW
DragQueryFileW
SHGetFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

VariantCopy
SysAllocString
SafeArrayCreateVector
SafeArrayAllocDescriptorEx
SafeArrayAllocData
VariantClear
VARIANT_UserFree
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysFreeString
SafeArrayGetVartype
VarR8FromDec
VariantTimeToSystemTime
BSTR_UserMarshal
VARIANT_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
LoadRegTypeLi
VariantChangeType
SysStringLen
RegisterTypeLi
VariantInit

rpcrt4

NdrStubCall2
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrOleFree
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrOleAllocate
NdrDllRegisterProxy
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllUnregisterProxy

Exports

Exports

AU3_AutoItSetOption
AU3_ClipGet
AU3_ClipPut
AU3_ControlClick
AU3_ControlClickByHandle
AU3_ControlCommand
AU3_ControlCommandByHandle
AU3_ControlDisable
AU3_ControlDisableByHandle
AU3_ControlEnable
AU3_ControlEnableByHandle
AU3_ControlFocus
AU3_ControlFocusByHandle
AU3_ControlGetFocus
AU3_ControlGetFocusByHandle
AU3_ControlGetHandle
AU3_ControlGetHandleAsText
AU3_ControlGetPos
AU3_ControlGetPosByHandle
AU3_ControlGetText
AU3_ControlGetTextByHandle
AU3_ControlHide
AU3_ControlHideByHandle
AU3_ControlListView
AU3_ControlListViewByHandle
AU3_ControlMove
AU3_ControlMoveByHandle
AU3_ControlSend
AU3_ControlSendByHandle
AU3_ControlSetText
AU3_ControlSetTextByHandle
AU3_ControlShow
AU3_ControlShowByHandle
AU3_ControlTreeView
AU3_ControlTreeViewByHandle
AU3_DriveMapAdd
AU3_DriveMapDel
AU3_DriveMapGet
AU3_Init
AU3_IsAdmin
AU3_MouseClick
AU3_MouseClickDrag
AU3_MouseDown
AU3_MouseGetCursor
AU3_MouseGetPos
AU3_MouseMove
AU3_MouseUp
AU3_MouseWheel
AU3_Opt
AU3_PixelChecksum
AU3_PixelGetColor
AU3_PixelSearch
AU3_ProcessClose
AU3_ProcessExists
AU3_ProcessSetPriority
AU3_ProcessWait
AU3_ProcessWaitClose
AU3_Run
AU3_RunAs
AU3_RunAsWait
AU3_RunWait
AU3_Send
AU3_Shutdown
AU3_Sleep
AU3_StatusbarGetText
AU3_StatusbarGetTextByHandle
AU3_ToolTip
AU3_WinActivate
AU3_WinActivateByHandle
AU3_WinActive
AU3_WinActiveByHandle
AU3_WinClose
AU3_WinCloseByHandle
AU3_WinExists
AU3_WinExistsByHandle
AU3_WinGetCaretPos
AU3_WinGetClassList
AU3_WinGetClassListByHandle
AU3_WinGetClientSize
AU3_WinGetClientSizeByHandle
AU3_WinGetHandle
AU3_WinGetHandleAsText
AU3_WinGetPos
AU3_WinGetPosByHandle
AU3_WinGetProcess
AU3_WinGetProcessByHandle
AU3_WinGetState
AU3_WinGetStateByHandle
AU3_WinGetText
AU3_WinGetTextByHandle
AU3_WinGetTitle
AU3_WinGetTitleByHandle
AU3_WinKill
AU3_WinKillByHandle
AU3_WinMenuSelectItem
AU3_WinMenuSelectItemByHandle
AU3_WinMinimizeAll
AU3_WinMinimizeAllUndo
AU3_WinMove
AU3_WinMoveByHandle
AU3_WinSetOnTop
AU3_WinSetOnTopByHandle
AU3_WinSetState
AU3_WinSetStateByHandle
AU3_WinSetTitle
AU3_WinSetTitleByHandle
AU3_WinSetTrans
AU3_WinSetTransByHandle
AU3_WinWait
AU3_WinWaitActive
AU3_WinWaitActiveByHandle
AU3_WinWaitByHandle
AU3_WinWaitClose
AU3_WinWaitCloseByHandle
AU3_WinWaitNotActive
AU3_WinWaitNotActiveByHandle
AU3_error
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Psycho Hatsher tool/Psycho Hatcher Tool.exe
.exe windows:6 windows x86 arch:x86

ffff45487d1e51fa972c8409931457df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb

Imports

kernel32

FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_seh_filter_exe
terminate
_set_app_type
_controlfp_s
_invalid_parameter_noinfo_noreturn
_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
exit
__p___argc
__p___wargv
_errno
_c_exit
_cexit
abort
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode
__acrt_iob_func
fputwc
fputws
__stdio_common_vsprintf_s
fflush
__stdio_common_vfwprintf
__stdio_common_vswprintf
_wfopen
setvbuf
_set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc
calloc

api-ms-win-crt-string-l1-1-0

strcpy_s
strcspn
wcsncmp
toupper
wcsnlen
_wcsdup

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_lock_locales
___lc_locale_name_func
___mb_cur_max_func
___lc_codepage_func
__pctype_func
setlocale
_unlock_locales
localeconv

api-ms-win-crt-math-l1-1-0

frexp
__setusermatherr

api-ms-win-crt-time-l1-1-0

_gmtime64_s
wcsftime
_time64

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Psycho Hatsher tool/Register - AutoItx3.bat
Psycho Hatsher tool/Register - AutohotKey.bat
Psycho Hatsher tool/Screen Dimensions .exe
.exe windows:5 windows x86 arch:x86

89586fa2a273a6233aa960d0905932f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:f3:48:6e:1d:d8:a9:10:30:34:a0:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

04/05/2020, 08:39

Not After

04/08/2023, 06:50

Subject

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:1d:44:f8:37:29:d2:54:5f:da:06:ca:b8:4e:7e:ed:59:67:ef:11:a2:1c:cd:81:d0:15:59:f5:77:75:7f:24
Signer

Actual PE Digest

21:1d:44:f8:37:29:d2:54:5f:da:06:ca:b8:4e:7e:ed:59:67:ef:11:a2:1c:cd:81:d0:15:59:f5:77:75:7f:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
GetStringTypeW
GetFileType
HeapAlloc
HeapFree
GetACP
WriteFile
GetStdHandle
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
CloseHandle
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
GlobalUnlock
GlobalLock
GetModuleHandleW
GlobalAlloc
FreeLibrary
CreateFileW
MulDiv
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW

user32

GetClassNameW
SendMessageTimeoutW
AttachThreadInput
GetWindowThreadProcessId
GetWindowLongW
GetParent
InvalidateRect
GetCursor
GetDesktopWindow
RedrawWindow
GetWindowDC
IsWindow
GetWindow
ChildWindowFromPointEx
ClientToScreen
EnumChildWindows
GetWindowTextW
GetDlgCtrlID
GetForegroundWindow
WindowFromPoint
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ReleaseCapture
SendDlgItemMessageW
SetCapture
SetCursor
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DefWindowProcW
MessageBoxW
DestroyWindow
KillTimer
PostQuitMessage
GetWindowPlacement
RegisterClassExW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
SetTimer
GetClientRect
SetWindowTextW
SetWindowPos
GetMenu
CheckMenuItem
LoadCursorW
LoadImageW
RegisterWindowMessageW
RegisterHotKey
CreateWindowExW
DestroyIcon
GetCursorPos
ReleaseDC
GetDC
MonitorFromPoint
IsWindowVisible
ShowWindow
EnableWindow
MoveWindow
ScreenToClient
GetWindowRect
SendMessageW

gdi32

DeleteDC
BitBlt
LineTo
MoveToEx
StretchBlt
PatBlt
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
SetROP2
GetStockObject
SelectObject
CreatePen
GetPixel
DeleteObject
CreateFontW
GetDeviceCaps

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Psycho Hatsher tool/UnRegister.bat
Psycho Hatsher tool/config.ini

Sharing

General

Malware Config

Signatures

Files

eef4c1fee903b2246d43be69a0d2a291

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 675KB - Virtual size: 674KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 11KB - Virtual size: 37KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 44KB - Virtual size: 44KB

296f11054858cd5d0f4e0a5ca0f1a6d3

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

38:f3:48:6e:1d:d8:a9:10:30:34:a0:4aCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

4a:5a:1e:9a:43:15:da:16:7a:03:db:d7:0d:f5:b5:21:63:8d:23:3a:26:b0:2c:76:26:ad:40:c2:6c:7a:77:e5Signer

Headers

File Characteristics

PDB Paths

Imports

mpr

winmm

comctl32

version

wsock32

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 479KB - Virtual size: 478KB

.orpc Size: 512B - Virtual size: 52B

.rdata Size: 175KB - Virtual size: 175KB

.data Size: 5KB - Virtual size: 10KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 19KB - Virtual size: 18KB

ffff45487d1e51fa972c8409931457df

Headers

DLL Characteristics

File Characteristics

.text
Size: 675KB - Virtual size: 674KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 11KB - Virtual size: 37KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 44KB - Virtual size: 44KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

38:f3:48:6e:1d:d8:a9:10:30:34:a0:4a
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

4a:5a:1e:9a:43:15:da:16:7a:03:db:d7:0d:f5:b5:21:63:8d:23:3a:26:b0:2c:76:26:ad:40:c2:6c:7a:77:e5
Signer

.text
Size: 479KB - Virtual size: 478KB

.orpc
Size: 512B - Virtual size: 52B

.rdata
Size: 175KB - Virtual size: 175KB

.data
Size: 5KB - Virtual size: 10KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 19KB - Virtual size: 18KB

.text
Size: 76KB - Virtual size: 75KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 18KB - Virtual size: 18KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

38:f3:48:6e:1d:d8:a9:10:30:34:a0:4a
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

21:1d:44:f8:37:29:d2:54:5f:da:06:ca:b8:4e:7e:ed:59:67:ef:11:a2:1c:cd:81:d0:15:59:f5:77:75:7f:24
Signer

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 2KB - Virtual size: 821KB

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 6KB - Virtual size: 5KB