mediafile.zip
- SHA256 c85830fe306de069caee5218dc8c8741b718ee8d9dd1975c91ce67b053db578e
Password
123
Behavioral task
behavioral1
Sample
mediafile.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
mediafile.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target mediafile.zip
- Size 2.0MB
- Sample240919-rychzstgmk
- SHA256 c85830fe306de069caee5218dc8c8741b718ee8d9dd1975c91ce67b053db578e
- MD5 d239d73b574c49b0087c81d3a4a47c71
- SHA1 b2af37882a29f745f3e3ec7f0caf528ae4f13360
- SHA512 2ccba109d5ef44318f36c0b2d9674b007541bf2ea469af56246a1ffc7a911d8a31bbfeabfb908505838aa8eb39a9b749d3ded7acd87fd75dc4a06ff4050f0cc5
- SSDEEP 49152:Cq7BCsx/Auf+HVjVGCTJu2BZaytCa4SuxpOJv:Cq9Fh8V3Ju2BfuOh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule static1/unpack001/mediafile.exe family_hijackloader - Hijackloader family
File Explorer
-
mediafile.zip.zip 2.0MB
-
mediafile.exe.exe 3.7MB
mediafile.exe
- IMPHASH d24263a43377e0bbd989c7401aac1b79
- SHA256 1bcc15d694501be5846d278419ca76e86904fb83c0e2337a8fb18627a32204b4
- MD5 be895bd5ac158111518ec50d41fcb871
- SHA1 25bf30d6d13f93c762b6f341bc629c29d9722326
- SHA512 fc65be37f401b7f373a502e340a42fd07db22d16583de906067c73a04398b8d99ffdc8d427024168c34fca3da93c71273c9b3b46eab383f9e8ed809d59711716
- SSDEEP 98304:wOCG4h7FiRe7WkAbJ0rCmIZDfNJBechU/dUq:3o7vWkwnmIZDfNJBegc
- MD5 SHA1 SHA512 SSDEEP
-
Detects HijackLoader (aka IDAT Loader)
Password
123
PE Signature issue
Digest
62:a5:c4:b4:26:96:90:21:d8:b6:34:7b:eb:75:d5:75:7d:7b:45:ef:78:1f:86:e1:e8:24:84:77:e5:b7:c7:09
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
Chains
Dec 11, 2021
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US
Serial Number
02:66:ad:fa:17:63:89:d9:b4:30:1a:c8:7e:fd:6a:96
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 14, 2021 - Apr 16, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
1742850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\tool\odin\Odin3\Odin3Downloader\Release\Odin3 v3.07.pdb
kernel32
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
SetFilePointerEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
ExitProcess
GetOEMCP
VirtualQuery
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
PeekNamedPipe
GetFileType
GetDriveTypeW
RtlUnwind
InterlockedPushEntrySList
GetCPInfo
GetStringTypeW
LCMapStringW
OutputDebugStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableA
GetStartupInfoW
IsDebuggerPresent
GetSystemTimeAsFileTime
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetUserDefaultLCID
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
FindResourceExW
GetWindowsDirectoryW
SetErrorMode
GetCurrentDirectoryW
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameW
GlobalFlags
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
GetThreadLocale
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
DeleteFileW
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetVersionExW
SuspendThread
SetThreadPriority
SetEvent
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
GlobalAlloc
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
LoadLibraryA
LoadLibraryW
GlobalFree
GlobalUnlock
GlobalLock
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeResource
OutputDebugStringA
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
ReadFile
ClearCommError
GetOverlappedResult
WriteFile
SetCommState
GetCommState
SetCommTimeouts
PurgeComm
SetupComm
SetCommMask
CreateFileW
CloseHandle
CreateEventW
ResetEvent
WaitForSingleObject
WaitCommEvent
WaitForMultipleObjects
GetProcessHeap
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
HeapFree
GetModuleFileNameW
ResumeThread
WideCharToMultiByte
VirtualFree
VirtualAlloc
GetPrivateProfileStringW
lstrcpyW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetTickCount
Sleep
GetExitCodeThread
MultiByteToWideChar
SizeofResource
FindResourceW
LoadResource
LockResource
SetStdHandle
WriteConsoleW
user32
SetTimer
DeleteMenu
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
LoadImageW
DestroyIcon
TrackMouseEvent
GetAsyncKeyState
LoadCursorW
GetSysColorBrush
CopyImage
IntersectRect
RealChildWindowFromPoint
CharUpperW
FillRect
ClientToScreen
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
SystemParametersInfoW
InflateRect
GetMenuItemInfoW
DestroyMenu
LoadMenuW
GetWindowThreadProcessId
SetCursor
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
GetCursorPos
GetMessageW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
RemoveMenu
InsertMenuW
GetMenuState
GetMenuStringW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
KillTimer
CharNextW
CopyAcceleratorTableW
EnableWindow
PostMessageW
SendMessageW
LoadIconW
LoadBitmapW
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
InvalidateRgn
SetRect
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
IsClipboardFormatAvailable
CreatePopupMenu
GetMenuDefaultItem
DrawFocusRect
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
SetWindowPlacement
GetWindowPlacement
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
GetSystemMenu
AppendMenuW
LoadAcceleratorsW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
TranslateAcceleratorW
GetWindowRect
wsprintfW
PeekMessageW
TranslateMessage
DispatchMessageW
InvalidateRect
UpdateWindow
UnregisterClassW
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
SetActiveWindow
GetWindowLongW
GetDesktopWindow
GetParent
GetKeyNameTextW
MapVirtualKeyW
GetDC
ReleaseDC
CopyRect
RegisterWindowMessageW
UpdateLayeredWindow
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsMenu
IsChild
SetWindowPos
MonitorFromPoint
GetComboBoxInfo
PostThreadMessageW
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
UnionRect
RegisterClipboardFormatW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
IsZoomed
DrawFrameControl
DrawEdge
DrawStateW
SetClipboardData
EmptyClipboard
gdi32
CreateRectRgn
CreateSolidBrush
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextMetricsW
CreatePatternBrush
GetMapMode
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreatePen
CreateHatchBrush
ExtTextOutW
GetTextExtentPoint32W
CreateCompatibleDC
BitBlt
DeleteDC
GetDeviceCaps
CreateDCW
CopyMetaFileW
CreateBitmap
GetObjectW
SetTextColor
SetBkColor
CreateRectRgnIndirect
GetStockObject
CreateFontIndirectW
CombineRgn
PatBlt
DeleteObject
msimg32
TransparentBlt
AlphaBlend
winspool.drv
ClosePrinter
OpenPrinterW
DocumentPropertiesW
advapi32
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
shell32
DragAcceptFiles
DragQueryFileW
ShellExecuteW
SHGetFileInfoW
SHAppBarMessage
SHBrowseForFolderW
DragFinish
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
StrFormatKBSizeW
PathStripToRootW
PathFindExtensionW
uxtheme
GetCurrentThemeName
GetThemeSysColor
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetThemePartSize
ole32
OleIsCurrentClipboard
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoRevokeClassObject
CoRegisterMessageFilter
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
DoDragDrop
oleaut32
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
OleCreateFontIndirect
LoadTypeLi
SysAllocString
SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SafeArrayDestroy
oledlg
OleUIBusyW
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
gdiplus
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipCreateFromHDC
GdipAlloc
GdiplusShutdown
GdipCreateBitmapFromScan0
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
winmm
PlaySoundW
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
446KB
Virtual Size
445KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.giats
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=241, version=40116,
count=196, id=243, version=40116,
count=33, id=242, version=40116,
count=6, id=199, version=41118,
count=2, id=261, version=23013,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=796, id=1, productName=Unmarked objects,
count=26, id=259, version=24123,
count=36, id=260, version=24123,
count=378, id=261, version=24123,
count=63, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,