hollows_hunter64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

hollows_hunter64.zip
Size

460KB
MD5

8bb1ee9a2b52c53ff8535b04e7b585ac
SHA1

ec276c330ac63b3ec563f7e770592ab88372f326
SHA256

cef6a6300f5275cc16d6b8ef9bed943eed3e2214f706148a330c355cd1182c63
SHA512

c1b010fecdfb1f6273a46ef20fb2a0c5a66c24d90e070dea67b8767ea7735d2493c5177bde4f90597d7f85fb4655ce244a62282086345c3eac9faf2e0bfe3964
SSDEEP

12288:V3/eUm4y1bAhFxtQ7Js8pVC9N1WidwMuiXcapnWV2yEdx4Nnr:5GUm4y1bAnxtvKC9jWaB0apnW8y2CNr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/hollows_hunter.exe

Files

hollows_hunter64.zip
.zip
hollows_hunter.exe
.exe windows:5 windows x64 arch:x64

78c80a9979684c7ccb093d6440ba946a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleFileNameExA
GetProcessImageFileNameA
GetMappedFileNameA
EnumProcessModulesEx
QueryWorkingSet

ntdll

NtCreateFile
ZwQueryInformationFile
NtQuerySystemInformation
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureContext

shlwapi

PathCanonicalizeA

kernel32

EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
HeapSize
GetTickCount
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
FlushConsoleInputBuffer
GetProcAddress
GetModuleHandleA
CloseHandle
OpenProcess
GetCurrentProcess
TerminateProcess
Process32Next
Process32First
GetLastError
CreateToolhelp32Snapshot
GetTickCount64
GetCurrentProcessId
GetCurrentThread
GetProcessTimes
SetLastError
LoadLibraryA
FreeLibrary
CreateFileA
ExpandEnvironmentStringsA
QueryDosDeviceA
GetLogicalDrives
GetCurrentDirectoryA
GetLongPathNameA
IsValidLocale
GetProcessId
WaitForSingleObject
CreateThread
IsBadReadPtr
GetFileAttributesA
GetWindowsDirectoryA
GetFullPathNameA
CreateDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualQueryEx
GetThreadContext
Wow64GetThreadContext
GetExitCodeThread
OpenThread
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
Thread32Next
Thread32First
WriteFile
ReadFile
VirtualAlloc
VirtualFree
ReadProcessMemory
VirtualProtectEx
QueryPerformanceCounter
GetEnvironmentStringsW
LoadLibraryW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
CreateFileW
SetEndOfFile
GetProcessHeap
TerminateThread
FreeEnvironmentStringsW
GetModuleFileNameA
GetTimeZoneInformation
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
Sleep
EncodePointer
DecodePointer
GetLocaleInfoW
HeapFree
RaiseException
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetCommandLineA
GetCPInfo
HeapAlloc
LCMapStringW
CompareStringW
HeapSetInformation
GetVersion
HeapCreate
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleHandleW
ExitProcess

advapi32

GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
ImpersonateSelf
LookupPrivilegeValueA
AdjustTokenPrivileges

dbghelp

SymInitialize
SymCleanup
StackWalk64
SymGetModuleBase64
SymFunctionTableAccess64

Sections

.text
Size: 652KB - Virtual size: 651KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c80a9979684c7ccb093d6440ba946a

Headers

DLL Characteristics

File Characteristics

Imports

psapi

ntdll

shlwapi

kernel32

advapi32

dbghelp

Sections

.text Size: 652KB - Virtual size: 651KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 15KB - Virtual size: 26KB

.pdata Size: 30KB - Virtual size: 30KB

text Size: 1024B - Virtual size: 798B

data Size: 7KB - Virtual size: 6KB

.rsrc Size: 163KB - Virtual size: 162KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 652KB - Virtual size: 651KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 15KB - Virtual size: 26KB

.pdata
Size: 30KB - Virtual size: 30KB

text
Size: 1024B - Virtual size: 798B

data
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 163KB - Virtual size: 162KB

.reloc
Size: 5KB - Virtual size: 5KB