ExtraHack[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ExtraHack.exe
Size

753KB
MD5

0df33d732b4632102682b2b0870b10bc
SHA1

f57d559a0e15219b6dae0077e28707d72fb99076
SHA256

5a38658d2f34c165dc9e63888b39525cfdc3e88ac6abc7a2a40a8b85681045db
SHA512

880574840774675a3a995f906df930d9bcdb6a1067480a93550110f0ca8046cfe43f81c81a7e9938da2d16dbb175fc700649a20022f4c1ff6feae674bb7db810
SSDEEP

12288:XL9dibDfGxjsdHcXjV1U2rBEFRRqDmXsslfF+gIMZ:XZdibbGxj9XDeimhfFeM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExtraHack.exe

Files

ExtraHack.exe
.exe windows:6 windows x64 arch:x64

Password: g33

1e166e0e24b9688eb1d7326af47330ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

CreateFontIndirectW
SelectObject
GetObjectW
CreateBitmap
CreateFontIndirectA
CreatePen
ExtFloodFill
GetPixel
LineTo
Rectangle
GetObjectA
CreateDIBSection
SetTextColor
SetBkMode
SetBkColor
GetStockObject
DeleteObject
CreateSolidBrush
RemoveFontResourceW
AddFontResourceExW
EnumFontFamiliesExW
GetDeviceCaps
SetDCBrushColor
SetDCPenColor
MoveToEx
ExtTextOutW
Polyline

uxtheme

GetThemeColor
CloseThemeData
OpenThemeData
SetWindowTheme
GetThemePartSize
DrawThemeTextEx
DrawThemeBackground

shell32

SHGetPathFromIDListW
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
SHGetFileInfoW
DuplicateIcon
SHBrowseForFolderW

user32

GetWindowTextW
SetWindowTextW
SetWindowTextA
GetWindowDC
SetForegroundWindow
DrawTextW
DrawMenuBar
GetSystemMetrics
IsWindowEnabled
GetDlgItem
BringWindowToTop
SetWindowPlacement
GetWindowPlacement
CreateWindowExW
GetMessagePos
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
LoadIconA
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
EnumThreadWindows
EnumChildWindows
GetParent
HideCaret
GetProcessDefaultLayout
SetClassLongPtrA
SetWindowLongPtrA
UpdateWindow
TranslateAcceleratorW
EnableWindow
GetAsyncKeyState
GetFocus
GetWindowLongPtrA
SetWindowLongA
GetWindowLongA
FillRect
ScreenToClient
GetSysColor
GetCursorPos
MessageBoxW
MapWindowPoints
DestroyIcon
CreateIconFromResourceEx
GetMenuBarInfo
SetMenu
CreatePopupMenu
DestroyMenu
AdjustWindowRectEx
AppendMenuW
RemoveMenu
SetMenuInfo
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
CreateIconIndirect
GetKeyboardLayout
GetClientRect
RedrawWindow
GetActiveWindow
SetFocus
GetNextDlgTabItem
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
RegisterClassExA
CallWindowProcA
PostMessageA
SendMessageW
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetDesktopWindow
GetWindowRect
ShowScrollBar
ReleaseDC
GetDC
DeleteMenu
GetSystemMenu
keybd_event
EmptyClipboard
PostMessageW
DefWindowProcA
PostQuitMessage
InvalidateRect
SetLayeredWindowAttributes
VkKeyScanExW
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
CreateMenu
TrackPopupMenu
ChildWindowFromPoint
CharUpperBuffW
CharLowerBuffW
ExitWindowsEx
OpenClipboard
GetWindowTextLengthW
SetActiveWindow
GetMenuItemCount
EndPaint
BeginPaint
CloseClipboard
SetClipboardData
GetClipboardData
SetCursor
SystemParametersInfoA
MonitorFromWindow
GetMonitorInfoA
GetAncestor
IntersectRect
OffsetRect
GetClassNameW
GetSysColorBrush
SystemParametersInfoW

kernel32

InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
LoadLibraryExW
GetModuleHandleW
GetCurrentThreadId
LocalAlloc
GetExitCodeThread
CreateThread
GetTickCount
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
FindResourceA
LoadLibraryW
SetDefaultDllDirectories
AddDllDirectory
SizeofResource
LockResource
LoadResource
VirtualProtect
lstrcmpiW
SetLastError
GetCurrentDirectoryW
SetCurrentDirectoryA
TerminateProcess
PeekNamedPipe
CreatePipe
SetHandleInformation
WriteFile
ReadConsoleW
FileTimeToSystemTime
MoveFileW
CopyFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
CreateFileW
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
GetLocalTime
CompareFileTime
WideCharToMultiByte
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
GetConsoleWindow
SetCurrentConsoleFontEx
GetCurrentConsoleFontEx
SetConsoleTitleW
GetConsoleTitleW
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
ReadConsoleInputW
ReadConsoleInputA
GetSystemTimeAsFileTime
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetCurrentDirectoryW
CreateDirectoryA
DeleteFileW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
Beep
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetTickCount64
AssignProcessToJobObject
SetInformationJobObject
GetModuleHandleA
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
CreateJobObjectA
MultiByteToWideChar
SetConsoleOutputCP
GetStdHandle
SetStdHandle
CreateFileA
ReadFile
MulDiv
AllocConsole
GetConsoleMode
SetConsoleMode

dwmapi

DwmGetWindowAttribute
DwmSetWindowAttribute

comdlg32

ChooseColorA
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromProgID
CLSIDFromString
CoCreateGuid

shlwapi

PathFindFileNameW
PathIsRelativeW
PathFindExtensionW
PathRemoveFileSpecW
PathIsDirectoryEmptyW
PathFindFileNameA

oleaut32

VariantTimeToSystemTime
VarDateFromStr
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
GetActiveObject

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comctl32

ImageList_Remove
ImageList_GetIconSize
ord413
ImageList_SetImageCount
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Draw
ord412
ord410
ImageList_GetImageCount
InitCommonControlsEx
ImageList_Create

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFindExtension
PFXImportCertStore

wininet

InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlW
FtpCommandW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpRenameFileW
FtpDeleteFileW
FtpPutFileW
FtpGetFileW
FtpFindFirstFileW
InternetCrackUrlA
InternetCloseHandle
InternetGetLastResponseInfoA
InternetReadFile
InternetSetCookieA
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetStatusCallback
InternetSetOptionA
InternetWriteFile
InternetReadFileExA
InternetConnectA
InternetFindNextFileW

ws2_32

accept
bind
closesocket
getnameinfo
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_addr
__WSAFDIsSet
inet_ntop
inet_pton
WSAAddressToStringA
WSAGetLastError
WSASetLastError
socket
shutdown
setsockopt
send
select
recv
ntohs
listen
inet_ntoa
htons
htonl
getsockopt
ioctlsocket
connect

secur32

EncryptMessage
DecryptMessage
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextA
QueryContextAttributesA
FreeContextBuffer
FreeCredentialsHandle
AcquireCredentialsHandleA

dnsapi

DnsFree
DnsQuery_A

iphlpapi

GetAdaptersAddresses

urlmon

FindMimeFromData

sensapi

IsNetworkAlive

advapi32

RegDeleteTreeW
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
RegGetValueW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyExW
RegDeleteKeyValueW
RegSetKeyValueW
CryptReleaseContext

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memmove
memchr
wcsstr
strrchr
__std_exception_copy
memcmp
memcpy
longjmp
strchr
strstr
wcschr
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__intrinsic_setjmp
__current_exception
__current_exception_context
memset

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
calloc
malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
system
_seh_filter_exe
terminate
strerror
_cexit
abort
_set_app_type
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
__p___argv
_errno
exit

api-ms-win-crt-stdio-l1-1-0

freopen_s
_fileno
__p__commode
fgets
_kbhit
fwrite
_get_osfhandle
clearerr
_fseeki64
_ftelli64
_pclose
_popen
setvbuf
tmpfile
ungetc
__stdio_common_vswprintf
__stdio_common_vfprintf
getc
freopen
fread
fopen
fflush
ferror
tmpnam
_wfopen
fputc
feof
fclose
__stdio_common_vsprintf
_wfsopen
puts
_telli64
_chsize_s
__stdio_common_vsprintf_s
fputwc
fgetws
fputws
_setmode
fputs
fseek
__stdio_common_vsscanf
__acrt_iob_func
_set_fmode

api-ms-win-crt-math-l1-1-0

frexp
fmod
__setusermatherr
tanh
tan
pow
floor
sqrt
ldexp
sinh
sin
log10
exp
log
acos
asin
atan2
ceil
cos
cosh

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale
localeconv

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-string-l1-1-0

strspn
strncpy
strcoll
strncmp
isdigit
strpbrk
_stricmp
isalnum
wcsncpy
_wcsdup
tolower
iscntrl
isgraph
ispunct
isspace
isxdigit
islower
isupper
isalpha
iswctype
toupper
_strdup

api-ms-win-crt-time-l1-1-0

_difftime64
_gmtime64
_localtime64
_mktime64
strftime
clock
_wutime64
_time64
_localtime64_s

api-ms-win-crt-environment-l1-1-0

getenv
_wgetenv
_wputenv

api-ms-win-crt-filesystem-l1-1-0

_waccess
rename
_wstat64
remove

Exports

Exports

File_close
File_open
LoadFont
TBuffer
TCOM
TDatetime
TDirectory
TFile
TPipe
TWidget
TWidgetItem
TWindow
TZip
WIDGET_METHODS
WM_LUAMAX
console_finalize
detectBOM
fontsize_fromheight
luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkDirname
luaL_checkFilename
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_embedclose
luaL_embedopen
luaL_error
luaL_execresult
luaL_fileresult
luaL_getlasterror
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_require
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_setrawfuncs
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkcinstance
lua_checkinstance
lua_checkstack
lua_close
lua_closeslot
lua_closethread
lua_compare
lua_concat
lua_copy
lua_createcinstance
lua_createinstance
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getevent
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettask
lua_gettop
lua_getupvalue
lua_iscfunction
lua_iscinstance
lua_isinstance
lua_isinteger
lua_isnumber
lua_isobject
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_objectname
lua_optstring
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushlwstring
lua_pushnewinstance
lua_pushnewinstancebyname
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushtask
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_registerevent
lua_registermodule
lua_registerobject
lua_registerwidget
lua_resetthread
lua_resume
lua_rotate
lua_schedule
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_sleep
lua_status
lua_stringtonumber
lua_super
lua_toBuffer
lua_toboolean
lua_tocfunction
lua_tocinstance
lua_toclose
lua_tointegerx
lua_tolstring
lua_tolwstring
lua_tonumberx
lua_topointer
lua_toself
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_uigetinfo
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_widgetconstructor
lua_widgetdestructor
lua_widgetinitialize
lua_widgetproc
lua_xmove
lua_yieldk
luaopen_base
luaopen_compression
luaopen_console
luaopen_coroutine
luaopen_crypto
luaopen_debug
luaopen_embed
luaopen_io
luaopen_math
luaopen_net
luaopen_os
luaopen_package
luaopen_string
luaopen_sys
luaopen_table
luaopen_utf8
luart_tobuffer
search_task
zip_close
zip_entries_delete
zip_entries_total
zip_entry_close
zip_entry_comp_size
zip_entry_crc32
zip_entry_extract
zip_entry_fread
zip_entry_fwrite
zip_entry_index
zip_entry_isdir
zip_entry_name
zip_entry_open
zip_entry_openbyindex
zip_entry_opencasesensitive
zip_entry_read
zip_entry_size
zip_entry_uncomp_size
zip_entry_write
zip_is64
zip_open

Sections

.text
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: g33

1e166e0e24b9688eb1d7326af47330ac

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

uxtheme

shell32

user32

kernel32

dwmapi

comdlg32

ole32

shlwapi

oleaut32

api-ms-win-shcore-scaling-l1-1-1

comctl32

crypt32

wininet

ws2_32

secur32

dnsapi

iphlpapi

urlmon

sensapi

advapi32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 439KB - Virtual size: 439KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 6KB - Virtual size: 10KB

.pdata Size: 27KB - Virtual size: 26KB

.rsrc Size: 179KB - Virtual size: 178KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 439KB - Virtual size: 439KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 6KB - Virtual size: 10KB

.pdata
Size: 27KB - Virtual size: 26KB

.rsrc
Size: 179KB - Virtual size: 178KB

.reloc
Size: 4KB - Virtual size: 3KB