hijackloader | FortiClientInstaller[.]exe

Resubmissions

07/04/2025, 17:19

250407-vv4pvayl1710

07/04/2025, 14:55

250407-sar47swjs210

Sharing

Copy URL Twitter E-mail

General

Target
FortiClientInstaller.exe
Size 1.3MB
Sample250407-sar47swjs2
SHA256 7b399ccced1048d15198aeb67d6bcc49ebd88c7ac484811a7000b9e79a5aac90
MD5 56ad9dbcf52a0a88e254be81b6fd3334
SHA1 981ea76962733330e35d027b2b89c8ba08c2c8d1
SHA512 6f3d1789eeebb03db3e1407f5e92b1c17d4136d171c2df09fd79c845e49e47f73a5f229f4e54be9f836ef7222c732e98f3b4ee6529077392d3d007a9afe0e856
SSDEEP 24576:0IWONZguqUO7j/vDnrUf6clUVIA6JGybfUPH/1gCKUmdrEH7fZ:0+ZyUOn/vDrQeVIJGyIvJSQZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\m545JfQz5
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FortiClientInstaller.exe

File Explorer

FortiClientInstaller.exe

.exe 1.3MB

FortiClientInstaller.exe

IMPHASH f2edebd181f49cbbeb011a52c91edc2d
SHA256 7b399ccced1048d15198aeb67d6bcc49ebd88c7ac484811a7000b9e79a5aac90
MD5 56ad9dbcf52a0a88e254be81b6fd3334
SHA1 981ea76962733330e35d027b2b89c8ba08c2c8d1
SHA512 6f3d1789eeebb03db3e1407f5e92b1c17d4136d171c2df09fd79c845e49e47f73a5f229f4e54be9f836ef7222c732e98f3b4ee6529077392d3d007a9afe0e856
SSDEEP 24576:0IWONZguqUO7j/vDnrUf6clUVIA6JGybfUPH/1gCKUmdrEH7fZ:0+ZyUOn/vDrQeVIJGyIvJSQZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CertNameToStrW CertGetCertificateChain CertFreeCertificateChain CryptUnprotectData

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExW

userenv

UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock LoadUserProfileW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

socket setsockopt inet_addr htons inet_ntoa bind ntohs ntohl WSAStartup send recv getsockname closesocket gethostbyname gethostname connect

kernel32

WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetFullPathNameW SetEndOfFile SetStdHandle EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetStdHandle GetModuleHandleExW ExitProcess MoveFileExW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType DecodePointer RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection GetCommandLineW ExpandEnvironmentStringsW GetLongPathNameW CloseHandle GetCurrentProcessId CreateProcessW ProcessIdToSessionId OpenProcess GetWindowsDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree LoadLibraryW Sleep FlushFileBuffers ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult SetEvent ResetEvent ReleaseMutex WaitForSingleObject WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateThread SetLastError OpenMutexW GetCurrentProcess GetSystemDirectoryW LoadLibraryExW LoadResource SizeofResource SetDefaultDllDirectories lstrcmpiW FindResourceW SetSearchPathMode MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW GetEnvironmentVariableW CreateFileW GetVolumeInformationW DeviceIoControl GetVersionExW SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeW GetFileAttributesExW TlsAlloc TlsGetValue TlsSetValue WriteFile SetNamedPipeHandleState WaitNamedPipeW WaitForMultipleObjects CopyFileW GetSystemInfo HeapAlloc HeapFree GetProcessHeap TerminateProcess FindFirstVolumeW FindNextVolumeW FindVolumeClose GetLogicalDrives GetVolumePathNameW QueryDosDeviceW GetVolumeNameForVolumeMountPointW HeapReAlloc HeapSize FindFirstVolumeMountPointW FindNextVolumeMountPointW FindVolumeMountPointClose WideCharToMultiByte TerminateThread GetTickCount FileTimeToSystemTime GetTimeZoneInformation GetLocaleInfoW CreateDirectoryW GetTempPathW CancelIo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetWaitableTimer CancelWaitableTimer GetCurrentThreadId CreateWaitableTimerW GetUserDefaultLCID GetACP SetThreadLocale GetUserDefaultUILanguage VirtualProtect VirtualQuery LoadLibraryExA QueryPerformanceCounter IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree InitializeCriticalSectionAndSpinCount GetStringTypeW

user32

IsWindowVisible CreateDialogParamW LoadMenuW DestroyMenu EnableMenuItem GetSubMenu TrackPopupMenu SetForegroundWindow InvalidateRect GetWindowTextW GetClientRect SetWindowPos MapWindowPoints GetWindowLongW GetWindow MonitorFromWindow GetMonitorInfoW OpenInputDesktop CloseDesktop GetThreadDesktop GetUserObjectInformationW SendMessageW ShowWindow PostQuitMessage DefWindowProcW GetCursorPos UnregisterClassW MessageBoxW FindWindowW GetWindowThreadProcessId GetMessageW DispatchMessageW LoadStringW GetParent SetWindowLongW GetWindowRect SetWindowTextW EnableWindow GetDlgItem RegisterWindowMessageW GetSystemMetrics DestroyIcon LoadIconW CharNextW DestroyWindow ExitWindowsEx PostMessageW

ole32

CoTaskMemRealloc CoTaskMemFree IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoInitializeEx CoInitialize CoCreateInstance CoUninitialize CoSetProxyBlanket

oleaut32

VariantCopy VarUI4FromStr VariantChangeType VariantClear VariantInit SysFreeString SysAllocString

Name

.text

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

857KB

Virtual Size

857KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

FortiClientInstaller.exe

crypt32

psapi

userenv

version

ws2_32

kernel32

user32

ole32

oleaut32

generic