P:\fi\GPU\SSD\4o\switch\Synchronization\Buffer\oe\x86\debug\server\firm.pdb
Behavioral task
behavioral1
Sample
c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f.exe
Resource
win10v2004-20240226-en
General
-
Target
c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f
-
Size
9.0MB
-
MD5
f7987a4bbcae5bec4109f0d4add8672e
-
SHA1
d01f2de116877c4125f74bd1106085e019d5e2fd
-
SHA256
c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f
-
SHA512
1c5a27826c77e72c3cad0d3ef1d67794481f75775aadf95598064c2b2ad74d6fc2510ae021ffd3de998b4b5e86e959c904c0f76a87202d8610a09304a475617c
-
SSDEEP
196608:or04S46+BHT0Bwl7GGlCfYB+w+Ug1LzKlH8l9:JjMTywlCGUYB+w+z6lk
Malware Config
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule sample family_hijackloader -
Hijackloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f
Files
-
c30afb9883f12b0cdb17caf2d8877107af99d51a35e3dc9efc1ff1f6e0163a6f.exe windows:5 windows x86 arch:x86
0542d0089ad33ee09d1fa893d5c462ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameW
TlsAlloc
InterlockedDecrement
TlsFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFileType
HeapSize
GetACP
GetStdHandle
HeapReAlloc
GetModuleHandleExW
ExitProcess
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
CreateEventW
GetStringTypeW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
lstrcpynW
lstrcpyW
DeleteFiber
SwitchToFiber
CreateFiber
TlsSetValue
ConvertThreadToFiber
TlsGetValue
OutputDebugStringW
WriteFile
SetEndOfFile
ReadFile
SetFilePointer
GetCurrentProcess
DuplicateHandle
GetFileSize
InitializeCriticalSection
GetVersionExW
lstrlenW
LockResource
LoadResource
FindResourceW
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
GetLastError
MultiByteToWideChar
SizeofResource
LoadLibraryExW
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LocalAlloc
FormatMessageW
LocalFree
CreateThread
GetModuleFileNameA
DecodePointer
SetLastError
MulDiv
LoadLibraryW
SetFileAttributesW
SetFileTime
CreateFileW
DeleteFileW
WideCharToMultiByte
GetFileAttributesW
WaitForSingleObject
FindFirstChangeNotificationW
CloseHandle
GetCurrentProcessId
lstrcmpW
user32
CharNextW
DefWindowProcW
CallWindowProcW
DrawEdge
wvsprintfW
SetWindowPos
ShowWindow
SendMessageW
MapWindowPoints
InvalidateRect
SetFocus
GetWindowLongW
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
LoadImageW
GetWindowTextW
GetWindowTextLengthW
TrackPopupMenu
InsertMenuW
LoadBitmapW
GetDC
CreateDialogParamW
DialogBoxParamW
EndDialog
PostThreadMessageW
GetMenuDefaultItem
ClientToScreen
SetMenu
UnregisterClassW
SetWindowLongW
wsprintfW
FillRect
GetSysColor
DrawTextW
GetMenu
DestroyIcon
GetDlgItemTextW
MessageBoxW
SetWindowTextW
GetDlgItem
SetDlgItemTextW
GetWindow
MonitorFromWindow
SetTimer
KillTimer
GetWindowThreadProcessId
GetSubMenu
GetMenuItemID
RegisterWindowMessageW
IsWindowVisible
GetKeyState
CharLowerW
IsWindowEnabled
IsMenu
SetWindowsHookExW
GetClassNameW
CallNextHookEx
UnhookWindowsHookEx
ModifyMenuW
DrawFrameControl
InflateRect
FrameRect
GetSysColorBrush
WindowFromPoint
GetFocus
PostMessageW
CreatePopupMenu
RemoveMenu
ReleaseDC
GetWindowDC
OffsetRect
GetSystemMetrics
AppendMenuW
MonitorFromPoint
TrackPopupMenuEx
GetMenuItemCount
GetActiveWindow
SystemParametersInfoW
SetRect
SetRectEmpty
SetCapture
UpdateWindow
SetCursorPos
GetCursorPos
ReleaseCapture
GetCapture
PtInRect
ScreenToClient
GetMessagePos
EndPaint
BeginPaint
GetClassInfoExW
RegisterClassExW
TranslateAcceleratorW
LoadAcceleratorsW
LoadMenuW
PostQuitMessage
LoadStringA
LoadStringW
DestroyWindow
MessageBeep
MsgWaitForMultipleObjects
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
IsWindow
DestroyMenu
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
CheckMenuRadioItem
LoadCursorW
SetCursor
CreateWindowExW
gdi32
GetCurrentObject
CreateDIBSection
CreateCompatibleBitmap
SetBrushOrgEx
CreateCompatibleDC
BitBlt
SetBkColor
LineTo
MoveToEx
CreatePen
PatBlt
CreateBitmap
CreatePatternBrush
CreateFontIndirectW
SetWindowOrgEx
OffsetWindowOrgEx
SelectObject
SetBkMode
SetTextColor
DeleteDC
DeleteObject
GetStockObject
GetObjectW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
SystemFunction036
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptReleaseContext
CryptDestroyHash
CryptAcquireContextW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
shell32
SHGetDesktopFolder
SHGetSpecialFolderLocation
ord23
ord21
SHGetFileInfoW
ShellExecuteW
ole32
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize
oleaut32
VarUI4FromStr
shlwapi
StrChrW
StrRetToBufW
PathFindExtensionW
PathAppendW
PathRemoveFileSpecW
PathRemoveFileSpecA
PathFindFileNameW
PathRemoveExtensionW
comctl32
ImageList_Draw
InitCommonControlsEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_LoadImageW
ImageList_Duplicate
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_AddMasked
CreateStatusWindowW
ImageList_Create
ImageList_DrawIndirect
msimg32
GradientFill
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 297KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ