hijackloader | LisectAVT_2403002A_201[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

LisectAVT_2403002A_201.exe
Size

9.2MB
MD5

e07a8dd6ca20053ba2a90cf52be73e43
SHA1

1a42c89ca50559c1a0668a8a8d31f0ce49620c05
SHA256

d9af261e2d79a7e6a13a86cda68e50f267129695ae2abb5ba92df720ac32a0b7
SHA512

97a8bad9c962a40ea2c9f5dd770962e84e4d9cad0ca95a87e7e202c84ab4773559b5d5ad025594b4a11f68b87ce2898837d26ab700d4ed62e92eea5a535f3b57
SSDEEP

196608:h6UDQWmkC75MSrTfm/E2nTOqyf39XHRRcV:/O7t/TeVnT3G3VHRS

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource yara_rule

sample family_hijackloader
Hijackloader family
hijackloader

resource	yara_rule
sample	family_hijackloader

Files

LisectAVT_2403002A_201.exe
.exe windows:5 windows x86 arch:x86

9b13505bcb03ec124610f57915418427

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-06-2022 00:00

Not After

22-06-2032 23:59

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:bf:98:22:41:2f:28:a1:85:83:06:9e:65:ca:8e:5d
Certificate

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Not Before

27-12-2023 00:00

Not After

02-06-2024 23:59

Subject

CN=Tixati Software Inc.,O=Tixati Software Inc.,L=Toronto,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

87:bd:99:6f:6a:5b:6a:ba:2b:d5:2c:f2:ee:c5:c8:b4:1c:84:b5:e4
Signer

Actual PE Digest

87:bd:99:6f:6a:5b:6a:ba:2b:d5:2c:f2:ee:c5:c8:b4:1c:84:b5:e4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

T:\8v\g\debugging\m\1\HTTPS\yp\zero\mo\proxy\x86\framework\i.pdb

Imports

msi

ord141
ord93
ord71
ord8
ord112

kernel32

IsDebuggerPresent
LocalFree
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetProcessWorkingSetSize
GetCurrentProcess
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
DeleteFileA
CloseHandle
GetLastError
CreateMutexA
GetCurrentProcessId
GetModuleFileNameA
GetTempPathA
LocalAlloc
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetProcAddress
GetModuleHandleA
SetStdHandle
GetLocalTime
HeapFree
GetModuleHandleW
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
GetFileType
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetHandleCount
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlUnwind
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b13505bcb03ec124610f57915418427

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0b:bf:98:22:41:2f:28:a1:85:83:06:9e:65:ca:8e:5dCertificate

Extended Key Usages

Key Usages

87:bd:99:6f:6a:5b:6a:ba:2b:d5:2c:f2:ee:c5:c8:b4:1c:84:b5:e4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

Sections

.text Size: 71KB - Virtual size: 70KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 6KB - Virtual size: 22KB

.rsrc Size: 9.1MB - Virtual size: 9.1MB

.reloc Size: 25KB - Virtual size: 25KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0b:bf:98:22:41:2f:28:a1:85:83:06:9e:65:ca:8e:5d
Certificate

87:bd:99:6f:6a:5b:6a:ba:2b:d5:2c:f2:ee:c5:c8:b4:1c:84:b5:e4
Signer

.text
Size: 71KB - Virtual size: 70KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 6KB - Virtual size: 22KB

.rsrc
Size: 9.1MB - Virtual size: 9.1MB

.reloc
Size: 25KB - Virtual size: 25KB