hijackloader | 5aa49622f3dafc184f903b7b78a2fd68[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5aa49622f3dafc184f903b7b78a2fd68.exe
Size 8.4MB
Sample240507-matedaed84
SHA256 285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84
MD5 5aa49622f3dafc184f903b7b78a2fd68
SHA1 28fd3345d82da0cdb565a11c648aff196f03d770
SHA512 fa7c3e619eb64355927fe4fe9ce925abba4c185b85816589a8e3bdf3ca7f0e73bb6c0ca939aa3699b29085f6d694eaf90f2224446156b80839d960a997b64d6d
SSDEEP 98304:YajcsQ5SggQZWfV1bihqdq7mXxUHp/nIaWl49u8cSu+A05TeKY7:cs3amByp/IpS9ASu+K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

File Explorer

5aa49622f3dafc184f903b7b78a2fd68.exe

.exe 8.4MB

5aa49622f3dafc184f903b7b78a2fd68.exe

IMPHASH bf4d9ea35fa5e6b3d85593ae6f971f8e
SHA256 285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84
MD5 5aa49622f3dafc184f903b7b78a2fd68
SHA1 28fd3345d82da0cdb565a11c648aff196f03d770
SHA512 fa7c3e619eb64355927fe4fe9ce925abba4c185b85816589a8e3bdf3ca7f0e73bb6c0ca939aa3699b29085f6d694eaf90f2224446156b80839d960a997b64d6d
SSDEEP 98304:YajcsQ5SggQZWfV1bihqdq7mXxUHp/nIaWl49u8cSu+A05TeKY7:cs3amByp/IpS9ASu+K
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)

PE Signature issue

Digest

2c:dd:1c:2b:f5:1e:9d:a2:51:bc:9e:6f:eb:9a:f9:7b:00:06:b1:02:3b:e7:45:1a:19:ae:be:28:09:1f:8f:ef

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FATİH RAMAZAN ÇIKAN,OU=IT,O=FATİH RAMAZAN ÇIKAN,L=ISPARTA,C=TR

Chains

Feb 29, 2024

CN=FATİH RAMAZAN ÇIKAN,OU=IT,O=FATİH RAMAZAN ÇIKAN,L=ISPARTA,C=TR

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=FATİH RAMAZAN ÇIKAN,OU=IT,O=FATİH RAMAZAN ÇIKAN,L=ISPARTA,C=TR

Serial Number

27:b8:de:4c:3f:63:fe:ae:04:71:f7:04:11:76:3d:db

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 29, 2023 - Aug 28, 2024

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

4934532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

winmm

sndPlaySoundW

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

ChooseFontW ChooseColorW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

Shell_NotifyIconW ShellExecuteW

user32

CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild SendDlgItemMessageW IntersectRect IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow GetAsyncKeyState IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC GetClassLongW SetScrollRange DrawTextW PeekMessageA MessageBeep SetClassLongW RemovePropW GetSubMenu DestroyIcon IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW NotifyWinEvent LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW EnumClipboardFormats GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsCharAlphaW GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement CreateWindowExW ChildWindowFromPoint GetDCEx PeekMessageW MonitorFromWindow AnimateWindow SetTimer WindowFromPoint DrawStateW BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClipboardData GetClipboardData ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect SetKeyboardState GetKeyboardState ScreenToClient DrawFrameControl IsCharAlphaNumericW SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CountClipboardFormats CallWindowProcW CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

GetErrorInfo SysFreeString VariantClear VariantInit SysReAllocStringLen SafeArrayCreate SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType VariantCopyInd

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

netapi32

NetWkstaGetInfo NetApiBufferFree

msvcrt

isupper isalpha isalnum toupper memchr memcmp memcpy memset isprint isspace iscntrl isxdigit ispunct isgraph islower tolower

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

kernel32

GetACP LocalFree CloseHandle GetCurrentProcessId SizeofResource VirtualProtect TerminateThread QueryPerformanceFrequency IsDebuggerPresent GetFullPathNameW VirtualFree ExitProcess HeapAlloc GetCPInfoExW GlobalSize RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile HeapSize GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW CreateMutexW LoadLibraryA ResetEvent GetVolumeInformationW MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread LoadLibraryExW LockResource FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount WritePrivateProfileStringW GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetTempPathW GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetProcessAffinityMask LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

shfolder

SHGetFolderPathW

ole32

IsEqualGUID OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

gdi32

Pie SetBkMode CreateCompatibleBitmap CreatePolygonRgn BeginPath GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc CloseFigure StrokeAndFillPath ResizePalette SetAbortProc SetTextColor StretchBlt PathToRegion SetArcDirection ExtSelectClipRgn RoundRect SelectClipRgn RestoreDC SetRectRgn FillPath GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW CreateICW PolyBezierTo GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits SetTextCharacterExtra GetTextCharacterExtra StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits CreatePenIndirect GetEnhMetaFilePaletteEntries SetMapMode GetMapMode CreateFontIndirectW PolyBezier ExtCreatePen LPtoDP EndDoc GetObjectW GetWinMetaFileBits SetROP2 PtVisible GetEnhMetaFileDescriptionW CreateEllipticRgnIndirect ArcTo CreateEnhMetaFileW Arc PolylineTo TextOutW SelectPalette SetGraphicsMode ExcludeClipRect SetWindowOrgEx MaskBlt EndPage EndPath DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect StrokePath PatBlt SelectClipPath SetEnhMetaFileBits Rectangle DeleteDC SaveDC BitBlt FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox GetClipRgn Polyline IntersectClipRect CreateBitmap SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection SetStretchBltMode GetDIBits LineTo GetRgnBox EnumFontsW SetWindowExtEx CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor GetBkColor CreateCompatibleDC GetObjectA GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex SetTextAlign GetTextAlign CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetViewportExtEx SetPixel EnumFontFamiliesExW StretchDIBits WidenPath GetPaletteEntries

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

131KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

92B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

441KB

Virtual Size

441KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5aa49622f3dafc184f903b7b78a2fd68.exe

PE Signature issue

winmm

oleacc

winspool.drv

comdlg32

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

winhttp

kernel32

shfolder

ole32

gdi32

generic