PassatHook[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

PassatHook.exe
Size

14.3MB
MD5

17d6d26dc0098d6fb32b7a02d943928e
SHA1

48832dcca4efa89526601ca1a76d517e1b21836c
SHA256

3da4b06bd1cf973032ad1bf001f9ddb9c7601d2f8d08b9dad8db58d3c62a9312
SHA512

57a96b8a4beab54e1a75c4907454e4fe8e0f815b06b3b231990440b4961754e18eb556faa61881eae39e6c8c5c746601f9da97434132631f1d052f42a97e688a
SSDEEP

393216:wl6kCijrGjW6ubR8vwr50M7kTGUJra35:OOiXGaaE09T25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PassatHook.exe

Files

PassatHook.exe
.exe windows:6 windows x64 arch:x64

08627697dd3730360eb9e552e79a070a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateDirectoryA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindowTextW

gdi32

GetDeviceCaps

shell32

ShellExecuteA

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

imm32

ImmGetContext

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

ferror

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

roundf

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

RegQueryValueExW

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.A&)
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.~1w
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YUX
Size: 14.3MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08627697dd3730360eb9e552e79a070a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

msvcp140

d3d11

d3dcompiler_47

dwmapi

winmm

imm32

d3dx11_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

advapi32

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 497KB

.data Size: - Virtual size: 3.1MB

.pdata Size: - Virtual size: 114KB

.A&) Size: - Virtual size: 7.6MB

.~1w Size: 5KB - Virtual size: 4KB

.YUX Size: 14.3MB - Virtual size: 14.3MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 497KB

.data
Size: - Virtual size: 3.1MB

.pdata
Size: - Virtual size: 114KB

.A&)
Size: - Virtual size: 7.6MB

.~1w
Size: 5KB - Virtual size: 4KB

.YUX
Size: 14.3MB - Virtual size: 14.3MB

.rsrc
Size: 512B - Virtual size: 480B