General

  • Target

    __0.zip

  • Size

    46.6MB

  • MD5

    cc8aa60492ff139f53a8bec66c8ee8aa

  • SHA1

    f489a8f792a9f1ce92dc86ee7042c0d39fa33043

  • SHA256

    2705018412749bb3e11bca68ba5d7052261f539a57d29437178de804757a4b2b

  • SHA512

    0e60aeb7156d1947f2fc955940b09870eb8159263b479e6144f9bd20c1885977706785b9ccc7afb6305acde7493fc345601b84d96cdbe22830e04b68aa856ab6

  • SSDEEP

    786432:zXpgiwvC/XLV7LpQNGY+bIl5+GZkWNb9uPaoh3Xaxp:z0YRLpE+k

Score
10/10

Malware Config

Extracted

Family

hijackloader

Attributes
  • directory

    %APPDATA%\dwekxkof

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Hijackloader family
  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • __0.zip
    .zip
  • #read.!t.gif
    .gif
  • Chertaing.dux
  • Data/ApplePushDirect.dll
    .dll windows:6 windows x64 arch:x64

    66433a21ddddb5872a8feb81324104ed


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/DomNodeList_count.phpt
  • Data/ReflectionProperty_getModifiers_basic.phpt
  • Data/bug46127.phpt
  • Data/bug61453.phpt
  • Data/bug81101.phpt
  • Data/ctor_promotion_additional_modifiers.phpt
  • Data/dll/ACEEXCL.DLL
    .dll windows:5 windows x64 arch:x64

    5fe60032e093896eaa0d670332174cea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/AsTaskSched.dll
    .dll windows:4 windows x86 arch:x86

    a76973d410bc591ed732eeeb05fccd2a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/Bass.Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/BravoInitializer.dll
    .dll windows:5 windows x64 arch:x64

    4646d7d2c7204ab2c18c4bfb72122d63


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/DirectXTex.dll
    .dll windows:6 windows x64 arch:x64

    ddd83ebf0657dd83fe0bbbc4975f7173


    Headers

    Imports

    Exports

    Sections

  • Data/dll/HarfBuzzSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/IntelQuickSyncDecoder.dll
    .dll windows:6 windows x64 arch:x64

    09b8f08b7a5e3dc4097f91de33292553


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/Microsoft.Azure.Relay.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.CodeAnalysis.CSharp.resources.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.DevTunnels.Ssh.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.Msagl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.ProgramSynthesis.Extraction.Web.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.Publish.Framework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.TeamFoundation.Build.Client.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.VC.Wizards.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.VisualStudio.QualityTools.Resource.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.VisualStudio.TemplateProviders.Implementation.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/Microsoft.WebTools.Languages.Html.VS.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/System.Collections.Immutable.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • Data/dll/System.ComponentModel.TypeConverter.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • Data/dll/System.Printing.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • Data/dll/System.Spatial.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • Data/dll/VBoxNetNAT.dll
    .dll windows:6 windows x64 arch:x64

    a7237948c9a5b4a8c4d83ab017b31def


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/WXFCMBPDF.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Data/dll/WebAppUpgrade.dll
    .dll windows:6 windows x64 arch:x64

    7a71890b71a543c147e35724c84961ad


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/libaribsub_plugin.dll
    .dll windows:4 windows x64 arch:x64

    dcc974c5b8d02c18f0fc1454525e1d98


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/libgdk_pixbuf-2.0-0.dll
    .dll windows:4 windows x64 arch:x64

    4a4c17c7850e4ede471b81b72b40a44d


    Headers

    Imports

    Exports

    Sections

  • Data/dll/libpostproc.dll
    .dll windows:6 windows x64 arch:x64

    41ba3ff5b148b1d0f88491538e26dd52


    Headers

    Imports

    Exports

    Sections

  • Data/dll/mc_dec_mpa.dll
    .dll windows:5 windows x64 arch:x64

    25ab4509be6aede7c3711c5fa24bea77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Data/dll/msvcp80.dll
    .dll windows:4 windows x64 arch:x64

    a9b64d8ae3db174bd1fbe56c3fdddd78


    Headers

    Imports

    Exports

    Sections

  • Data/make_i386_sysv_elf_gas.S
  • Data/mod_tidy_replace_old.txt
  • Data/nearzero.c
  • Data/opcache.stub.php
  • Data/open_basedir_opendir.phpt
  • Data/pdo_sqlite_createcollation.phpt
  • Data/realize_proxy_overridden.phpt
    .js
  • Data/sljitNativeLOONGARCH_64.c
  • Data/str_offset_008.phpt
  • Data/temporary_cleaning_013.phpt
    .js
  • Data/try_multicatch_001.phpt
    .js
  • Data/zlog.c
  • DuiLib_u.dll
    .dll windows:6 windows x86 arch:x86

    2db18c945c2d53635ab6e4c76df4be2f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/GpuProfilingAnalyzer.dll
    .dll windows:6 windows x64 arch:x64

    d649736e9485206d0c3b4d782e87f486


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/Jpg_transform.dll
    .dll windows:6 windows x64 arch:x64

    7d0cd6ef877021f3d54ac34e3bbc0873


    Headers

    Imports

    Exports

    Sections

  • MigrationService/Microsoft.AspNetCore.Mvc.Abstractions.dll
    .dll windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • MigrationService/Microsoft.CodeAnalysis.EditorFeatures.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/Microsoft.WebTools.Azure.VS.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/NCOverlays.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    110c546bf4186687faa4ae89d151628d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/RecipientDirectoryDialog.resources.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/SecurityChecks.dll
    .dll windows:6 windows x64 arch:x64

    a3a500512b73ec740b370a7f06ce3b14


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/System.IO.Compression.FileSystem.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/WPFHexaEditor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/cdio.dll
    .dll windows:6 windows x64 arch:x64

    79e68877b521ef388b482bf38daa82b3


    Headers

    Imports

    Exports

    Sections

  • MigrationService/icuin30.dll
    .dll windows:4 windows x64 arch:x64

    65f61fba4e0113660fd5668c9aedc849


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/legal/Animal 2.png
    .png
  • MigrationService/legal/Locals3.png
    .png
  • MigrationService/legal/NavigationPeekDefinition.png
    .png
  • MigrationService/legal/Xmas 1.png
    .png
  • MigrationService/legal/bin/acountry.exe
    .exe windows:4 windows x64 arch:x64

    84565499fdfa054a2e4c8b3065734167


    Headers

    Imports

    Sections

  • MigrationService/legal/bin/atkexComSvc.exe
    .exe windows:6 windows x86 arch:x86

    6ec3cbfff81ce9640c4ea33136be589a


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/legal/bin/bzcat.exe
    .exe windows:4 windows x64 arch:x64

    e4485f82538c7ecd462fcaa89c1f584b


    Headers

    Imports

    Sections

  • MigrationService/legal/bin/edit_test_dll.exe
    .exe windows:4 windows x64 arch:x64

    902655be947a2e258a6ff976c48ea188


    Headers

    Imports

    Sections

  • MigrationService/legal/bin/git.exe
    .exe windows:4 windows x64 arch:x64

    c7b75eb82135812c5196816cf05bce1d


    Code Sign

    Headers

    Imports

    Sections

  • MigrationService/legal/bin/xmlwf.exe
    .exe windows:4 windows x64 arch:x64

    2b7294fdd6520932443672ef95b783ed


    Headers

    Imports

    Sections

  • MigrationService/lib_lightgbm.dll
    .dll windows:6 windows x64 arch:x64

    30db1bba1af61d6703959ba2cd1ca233


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/ssleay32.dll
    .dll windows:6 windows x86 arch:x86

    e4a4705b915df563d9a8383c3d2a0dfb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MigrationService/wab32res.dll
    .dll windows:10 windows x64 arch:x64


    Headers

    Sections

  • Rapid/Config/8859-8.txt
  • Rapid/Config/DisplayLanguageNames.fr_BE_PREEURO.txt
  • Rapid/Config/Help-ja_JP.txt
  • Rapid/Config/Persian.txt
  • Rapid/Config/UnsupportedTargetFrameworks.txt
  • Rapid/Config/build_cache_trimpath.txt
  • Rapid/Config/build_no_go.txt
  • Rapid/Config/example.com_cmd_v1.0.0-exclude.txt
    .js
  • Rapid/Config/example.com_notags_v0.0.0-20190507143103-cc8cbe209b64.txt
  • Rapid/Config/example.com_quote_v1.5.2.txt
  • Rapid/Config/help.be.txt
  • Rapid/Config/mlang.txt
    .js
  • Rapid/Config/mod_bad_filenames.txt
  • Rapid/Config/mod_get_retract_ambiguous.txt
  • Rapid/Config/rsc.io_quote_v2.0.0.txt
  • Rapid/Config/test_badtest.txt
  • Rapid/Config/todo.txt
  • Rapid/Config/trampoline_reuse_test.txt
  • Rapid/Config/work_why_download_graph.txt
  • Rapid/action.yml
    .vbs
  • Rapid/active_formatting.h
  • Rapid/bug47021.phpt
  • Rapid/bug64342_1.phpt
  • Rapid/bug70312.phpt
  • Rapid/bug75420.12.phpt
  • Rapid/bug78379_2.phpt
  • Rapid/calc_array.phpt
    .js
  • Rapid/dereference_004.phpt
  • Rapid/frontcontroller18.phar
    .js
  • Rapid/ldap_connect_ldap_conf.conf
  • Rapid/noway.zip
    .zip
  • noway.txt
  • Rapid/send_returns_current.phpt
  • Rapid/timezone_getDisplayName_variant1.phpt
  • Setup.exe
    .exe windows:6 windows x86 arch:x86

    21206fc81e70e758a93b74d8a0e00bfe


    Code Sign

    Headers

    Imports

    Sections

  • Verkloon.ef
  • msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    e1960ead066eca55c4492b941249fb99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    b06d4116da69a513992d529f84731e6f


    Code Sign

    Headers

    Imports

    Exports

    Sections