hijackloader | 40122c3fc307277bbcb516dce390f74f27e2f798cb351[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe
Size 5.6MB
Sample241003-tdcpcstdkp
SHA256 40122c3fc307277bbcb516dce390f74f27e2f798cb351a692f820ba7d3ffd735
MD5 07dd73909e1a74b92498058afc918ede
SHA1 2f3f9ab4f17ccd2dfe0c4aada522b00c580c454d
SHA512 97f66cd575203cfbd0d584475c6696b160071e95466e5dde8b71d66138108f0b4d544af24706720960509fd7fd21bef07e443995457de3805168672844901853
SSDEEP 98304:XUd9wETbKHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:MwgbKM44YCxwxmzLOFfdrq+P/xnCoEIh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

File Explorer

40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

.exe 5.6MB

40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

IMPHASH c3e91fbd563a72c79722e447bd1614b5
SHA256 40122c3fc307277bbcb516dce390f74f27e2f798cb351a692f820ba7d3ffd735
MD5 07dd73909e1a74b92498058afc918ede
SHA1 2f3f9ab4f17ccd2dfe0c4aada522b00c580c454d
SHA512 97f66cd575203cfbd0d584475c6696b160071e95466e5dde8b71d66138108f0b4d544af24706720960509fd7fd21bef07e443995457de3805168672844901853
SSDEEP 98304:XUd9wETbKHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:MwgbKM44YCxwxmzLOFfdrq+P/xnCoEIh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)

PE Signature issue

Digest

5a:34:35:7a:1e:0e:5c:02:80:be:db:f6:75:e8:2a:64:da:18:6f:74:c2:20:40:6a:2c:79:19:c1:2c:da:5d:81

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Chains

Aug 12, 2024

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Serial Number

56:21:cb:0b:b7:52:7f:9b:05:d2:ee:53:99:51:59:80

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2021 - Sep 27, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

250443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\FastCopy\src\install\Obj\ReleaseInst\setup.pdb

kernel32

ReadFile FindFirstFileW FindNextFileW WriteFile FindClose WaitForSingleObject CreateFileW DeleteFileW CloseHandle GetLocalTime GetFileSize GetSystemTimeAsFileTime CreateDirectoryW GetCommandLineW GetFullPathNameW RemoveDirectoryW GetModuleFileNameW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress CreateProcessW FreeLibrary CopyFileW SetDllDirectoryW MoveFileW GetEnvironmentVariableW VirtualProtect EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetTempPathW Sleep GetLastError SetEvent GetVersionExA DeleteCriticalSection GetModuleHandleW GetEnvironmentStringsW GetStdHandle WriteConsoleA OutputDebugStringA GetCurrentThreadId AttachConsole OutputDebugStringW WriteConsoleW GetFileType InterlockedIncrement GetTickCount SetThreadLocale SetLastError GetCurrentProcess GetSystemDirectoryW OpenProcess CreateToolhelp32Snapshot Process32NextW GetUserDefaultLCID Process32FirstW LoadLibraryW GetCurrentProcessId MultiByteToWideChar MoveFileExW WideCharToMultiByte ExitProcess SetFileTime UnmapViewOfFile GetFileAttributesExW CreateFileMappingA MapViewOfFile GetFileTime GetModuleFileNameA SetEndOfFile RaiseException CreateThread SetUnhandledExceptionFilter GetSystemInfo VirtualQuery LoadLibraryExA GetStringTypeW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetACP HeapFree HeapAlloc HeapReAlloc IsValidLocale EnumSystemLocalesW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA FreeEnvironmentStringsW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize SetFilePointerEx ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

PE Signature issue

kernel32

generic