hotk[.]dll | Triage

General

Target

hotk.dll
Size

28KB
MD5

3bbce963b43b17790d811204176c4c04
SHA1

ca02a7aec954c0db309a7bb74a1518896bd5f8e8
SHA256

41d4550bc63dfe9b25b8038b4edfa3460f66df41e2ad1ee0bfcb71bfc27114dc
SHA512

69c4f10d37168ec9260410f47e3ef5b2368ec30af1dd6848836e7bc252528236d9144f003e20d9c8452a448f4ddb1ed8fb8a5b86106c46e954c3da4612b1180c
SSDEEP

384:G/C8sxpTiNLXjTrNmlU+UeyimahZtoIo9/1k:GNEpTixzTLe79PCIo9tk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hotk.dll

Files

hotk.dll
.dll windows:4 windows x86 arch:x86

21a17c42c2bd5fd7acf8b450dd022b89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
PostMessageA

kernel32

GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
GetStringTypeW
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcAddress
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LCMapStringW
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeA

Exports

Exports

?SetHook@@YAHPAUHWND__@@@Z
?UnHook@@YAHXZ
?ghWnd@@3PAUHWND__@@A
?gnHotKey1@@3KA
?gnHotKey2@@3KA
?nHook@@3HA

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

._HOOK
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21a17c42c2bd5fd7acf8b450dd022b89

Headers

File Characteristics

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

._HOOK Size: 4KB - Virtual size: 12B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

._HOOK
Size: 4KB - Virtual size: 12B

.reloc
Size: 4KB - Virtual size: 1KB