���X4 6*_��ᮋ%U��5|�QSU Zoi`: ���0��$��b�.�Dx�Rtg\H�tMq�ٯ�\X� ��p��&qYn�,v����.����r���z���lRKūޮ%��<)�fdy3�������Ɠk��Ħ���ӳ�8gX(�)�ண�y���@����`�8�*�%+Pa�0ѵ���H���l��^3�$��}�S�֏У��c?m��O�FU�ek�Ԓq��=��:UY�PbK�1��u=��� ��7O<l�����6��m}�og-ɽ���X���K��-9�SѸ�����!�����u%��{�G���ف������fT1��8���]�u�_��j�' �h$���5��K���%��oFA���T�F�_����l�ln�:�|�充ds���TB�Z1�u��8o�#`�is�ќ7{U�^���Bೀ��p������ �XR�7���Ƚ�5�}l�`_�� zױځ!��GB�JN����3��]\��O�7(��V�B��ݰ�oY L�+${b��S�6R+�<�{+$ل+ÎY������� �}��@2�mU�u�U�S��mϲ�)�5�qF��ӛ� nVk�L�������-␄bv�_�X��~��u���U�m,SH@jpr�hr'��GE��_> �sg3��ʲ�zu�jõ#93���n�l4`zd���T�җpx�a"��oUf¨�����N�R�5̔�!!o���]%*���r�B�K.+���ʟ���Px��T���$���!(!�!�����C��9�G�S�s�G�A������=F����/}[���F1)������5�)��{�_8��G����αlE ����%��K�%��L�����(��Ck�����qS����3��d2��Q~^��?q�F� �>$wF!�ͯ�Ejt��;0O�Ň�3Ԇ~���B?��0'�i�jX�4�����t|����X%S� 7v���w$�E����)S�0��IPjA�aWή��qP����ٓ�l�i�V��;`8R8e*��ѡ�o�@���W�Z�%�ם`� o��'0n+J���ht�T����b�9#���Hh�!h�Z_qz\�y���\ͳ��Y�u����`3� ����@��#럂�~�������ҐP�7]���q�N�pj��:b�)��s1��y�h�0?y1|C.eRAǛMƛn�)�m��9��'�?���o��Ҋ�Zu�a��Q[fI#U�����tV+&$�Z ����G�J�,��XY���+�ۀ� ]�`��4&}��w�a��ƴ�D�8�$���41�H�r�oB�`�zK�C��՜��=�*a��3p�q �F�-���?��p����+nFH��~m˭�.;�k~z����N����� і��,6����.���>�#--�|�0���2�F�x�=#Y�@;؎* �|�r%�# mLU�z8��G��Q�%�"J����6='��ٲ�٢̆��{������o6�5Q�Yz����0)#�V�g�o��Ʃd#����^b�2�-�(��(Ӽ��i�Yd���R�imgd��6U���ݹ�M�)�65������u�C:|7\lk��N?�CSo��>d� X�*��^H��z��<��2�%Md��9W-k��R���3aư7����4 ��x�`}H��H� m�'.�6ݰQ��l��O��®���H�&�=]�B�q{�ۛL�(����?/��n*�z�\�b۠�'�7��n��q��8�(fwP��:���].��S�u+wl��� ���NN�z�k���q*���B��[�h��4 ˠʆUj��%d���T�j��lpY�!X2�d'U=;w�v���!B��UP�3�C.���ű3?��dS�L-��&�Tи����p�����*��j4%��3�>�6O�L�IR]L���{�3 q2�.�{�&~T:}������{��O9Cm�i�Jؐ�e���p��g����Ω�^_��4R���U��/x;8ע��͛ 5�ܤ%x�N���R�>����Cp-�4���j#'��$r��������E%�q+��@�8�������������ͭ�,KL��yfHE�P�b��XP2N~M��w���V�xH���'8��g�6�Wh�)R��Ek!'�r�f~mU�����:7#�t��Z�xei5��N3�aw��2oV��w�|2�'�Pe��zr����Z��5�u��L��.����]sO��ˤso��� C�Xp�0���� $�p$P������r:�5��,<q~�)�ܰ�t� jA���uC~!�c����xv��C�i���]����Ç�"J(d�gh��=�=���s�wy��~I)iU�I�&7�%Iȟ|���`�W�����)������� �c��G��ԑٶ�eC%�a�&��;����/���E���/�=�zl+@�,N1t ��c�$��� r��z/P�E�06��EY5��tL$��c�bUr�̻H][�ߟ���%[_MW��F�0�n,F�[�Lx��u�<��.1�`�b/-�3���3E]��o4��u*�;W6E�+��"�r�h���{L�}T7���YC%��(��R@����=� �r ��/�/�f�B ��)�7�A0џ��\���&�(?��Ԟu�4��P�.PW��O���Lr�MK���@X�y��4����v�NF�����w7�|��x�8ѕ�,��D3�����e��W��+�� :3����UD�؆M�V��\�=��R�Z�+b�<ޑj �1;,jO�Xl�T1���WCTY`Ξ��δ_�6�Z���猑*��|j��/x�ݞ�N����hyL�qT�3�x/��W���M�[:�"R��bty��n����@iw�}X_h��t�/���� ���ķN5L�s�٬����]�LĒ,xDH�V���Oξܬ��oo�ҹ����EY��ǘ�ĜS���j]V���:m}?k[cv/T�ҿ�-�a�F�y�a_��5iY�U��D�����g�_��WZBb��(�x�z�q�������'q5��2h�0��D{��m�/ 㲀����\�y,����wI�^���P>��H����5K�*�����b-�F����L:��}Q�v;^��k҆�b�qUa^��50�\�<��5f�8��a�����?�d��պإd(Œ���LC'��Sf�� ¤�4��c����a/W��%�e�ՌC*sY~w�f)B� \R&ݹ�a]HM0��q��������A+��K����-���/��l���kabV��}!C�B�bu��a��<:Ȥ���_�!��. ��������TbA�*Ӡ�!-�`d��Bܵ��F_ ry��E��C��3�C-��'òJ�2�;������ ��>4�^�`���o��)���Xʏ�KE-��cO�Ӥ�$8д�`��V���/��dQn��O��)�t��K�uZ�h�>�E�h�Ġ"�2����t��-n+�8%$�"6U�'��@����
Static task
static1
Behavioral task
behavioral1
Sample
HyperHook_Temp.exe
Resource
win10v2004-20240426-de
General
-
Target
HyperHook_Temp.exe
-
Size
20.4MB
-
MD5
1882e8d2806fca8b52d05f56b099eecd
-
SHA1
0f7bc10ceb94674b40e376ac45542e329d9538a1
-
SHA256
b3ea6555cb3f456821adf307e409f56e4b7ac7cfc199d1eaa85961c6da832d2d
-
SHA512
9c345595857ea1cc4f1c44d9dc5eff5068836eda28f18a4729e69f2b6d5d3e46e3d71807d5a77d822da4bdd5e15616e3a43e2a6400b6606901c85fd585520812
-
SSDEEP
393216:srXgWSibhDkZpWtDkytuN52Mo5uqY88bwg91TFFMnOe7OvEjldPkwtNlm2Dqv9wF:6XNHkZpW5kyIMuB88bw41Z6nevEjzrxZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HyperHook_Temp.exe
Files
-
HyperHook_Temp.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 337KB - Virtual size: 880KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.3MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 47.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE