Static task
static1
General
-
Target
PassatHook.exe
-
Size
16.4MB
-
MD5
ec0832f7f40ef1105011df1d59f65d87
-
SHA1
49c89cb6d21b8e4f0710766a6e52df27ed449341
-
SHA256
329f241dcf6edc4d2ac8f61f8ff7d14de12b5ecb84bc18509a8b7a3d7b97901e
-
SHA512
e48647a03f6d1277cd2f9dc9a85c81f16a22b656bc72ae0287c09c455df4c1df6c5fe1a1913e579b298669c91cad48f28e7acf78202fb0892a5e69eae62c5f69
-
SSDEEP
393216:UJkATycHrBGniCdru1Icunr5VtW6bgkX+ZwY:ejBSDrwIcYrYtk+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PassatHook.exe
Files
-
PassatHook.exe.exe windows:6 windows x64 arch:x64
f61c385414a1b3e86f54ba6ff04ca6cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UpdateWindow
gdi32
GetDeviceCaps
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundA
imm32
ImmGetContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-time-l1-1-0
_ctime64_s
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
rand
advapi32
RegCreateKeyExW
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y[x Size: - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.w@p Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.s%X Size: 16.4MB - Virtual size: 16.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ