D:\Recent\ATKRelation\Universal\Setup_PNP_Universal_Screensaver\x64\Release\Setup64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_267311006d574f81b8a0531975d66253_black-basta_hijackloader.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-14_267311006d574f81b8a0531975d66253_black-basta_hijackloader
-
Size
155KB
-
MD5
267311006d574f81b8a0531975d66253
-
SHA1
e4805d76d3d75fdf607a1fd6eafb29ba888bfc53
-
SHA256
262ae19ad7614030da86aa18fca946aa84386a43f9b914ddf0beda2e45a9f1ba
-
SHA512
57b30d398d9d6a728dcc563635f5a94dc2b56ab28927be675984f88f3b098d447cacb9641760f892e3140df99bd089a75378d2d66a4b56fc02f817195743cfe0
-
SSDEEP
3072:umN9j7XoCO7gg2t0qcmwCVMzZsSIDqQUqeRmxUoNRDuUlbw4:uGRkCqi0qcmZMKiqaojDuUlT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-14_267311006d574f81b8a0531975d66253_black-basta_hijackloader
Files
-
2025-05-14_267311006d574f81b8a0531975d66253_black-basta_hijackloader.exe windows:6 windows x64 arch:x64
4e7e4ef7999b436c8dea0fb7f6844b97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineA
GetStdHandle
GetCommandLineW
GetEnvironmentStringsW
SetStdHandle
FreeEnvironmentStringsW
api-ms-win-core-heap-l2-1-0
GlobalFree
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l1-1-0
SetFilePointerEx
FlushFileBuffers
GetFileType
WriteFile
FindClose
CreateFileW
FindFirstFileExW
FindNextFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
ExitProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
shell32
CommandLineToArgvW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlUnwindEx
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsAlloc
FlsFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-core-localization-l1-2-0
GetACP
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapSize
HeapReAlloc
api-ms-win-core-console-l1-1-0
GetConsoleMode
GetConsoleCP
WriteConsoleW
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ