General

  • Target
    ยซ๐šˆ๐šž๐š›๐šœ๐™ต๐š’๐š•๐šŽ๐š๐šŽ๐šŠ๐š๐šข๐™ณ0๐š†๐™ฝ๐š•ร–๐šŠ๐šยซยซ4405ยปยป_ยป.7z
  • Size 8.7MB
  • Sample251108-ppf4psypbp
  • SHA256 4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\com_adv_foundation_dbg

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Hijackloader family
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was Codesigned using an insecure algorithm.

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 8 IoCs

    Codesigned binary was signed by an untrusted entity.

File Explorer

  • ยซ๐šˆ๐šž๐š›๐šœ๐™ต๐š’๐š•๐šŽ๐š๐šŽ๐šŠ๐š๐šข๐™ณ0๐š†๐™ฝ๐š•ร–๐šŠ๐šยซยซ4405ยปยป_ยป.7z
    .7z 8.7MB
  • BugSplat64.dll
    .dll 545KB
  • Library/CloudMeService.dll
    .dll 374KB
  • Library/MOG_Framework_2.2.14_vc10.dll
    .dll 301KB
  • Library/MSHY7EN.DLL
    .dll 218KB
  • Library/MSODCW.DLL
    .dll 671KB
  • Library/MemoryProfilerCollectionAgent.dll
    .dll 209KB
  • Library/Microsoft.AspNetCore.Mvc.Razor.dll
    .dll 242KB
  • Library/Microsoft.AspNetCore.SignalR.Core.dll
    .dll 450KB
  • Library/Microsoft.CodeAnalysis.AnalyzerUtilities.dll
    .dll 530KB
  • Library/Microsoft.TeamFoundation.SharePointReporting.Integration.dll
    .dll 212KB
  • Library/Microsoft.TeamFoundation.VersionControl.UIFeatures.dll
    .dll 491KB
  • Library/Microsoft.VisualStudio.DesignTools.XamlDesignerHost.dll
    .dll 752KB
  • Library/Microsoft.VisualStudio.Text.Core.Implementation.dll
    .dll 362KB
  • Library/Microsoft.VisualStudio.TraceCollector.dll
    .dll 238KB
  • Library/NativeCodeAnalysis.dll
    .dll 237KB
  • Library/NuGet.DependencyResolver.Core.dll
    .dll 218KB
  • Library/ONBttnWD.dll
    .dll 629KB
  • Library/PPI-NVIDIA.dll
    .dll 300KB
  • Library/Qt5Qml.dll
    .dll 3.2MB
  • Library/WzWXFlc64.dll
    .dll 608KB
  • Library/_Fs.dll
    .dll 297KB
  • Library/netstandard.dll
    .dll 1.3MB
  • Library/onnxruntime.dll
    .dll 2.3MB
  • Library/swresample-progdvb-4.dll
    .dll 217KB
  • Library/vccorlib140d.dll
    .dll 1.4MB
  • Resource/026.phpt
    .js 381B
  • Resource/043.phpt
    4KB
  • Resource/SnP-Relaned.h
    5KB
  • Resource/array_sum_basic.phpt
    848B
  • Resource/asinh_variation.phpt
    716B
  • Resource/bug40451.phpt
    467B
  • Resource/bug47572.phpt
    333B
  • Resource/bug50005.phpt
    330B
  • Resource/bug53511.phpt
    .js 580B
  • Resource/bug54323.phpt
    537B
  • Resource/bug67118.phpt
    .js 879B
  • Resource/bug71572.phpt
    .js 742B
  • Resource/bug74705.phpt
    429B
  • Resource/ctype_punct_basic.phpt
    405B
  • Resource/curl_copy_handle_xferinfo.phpt
    626B
  • Resource/errmsg_036.phpt
    222B
  • Resource/error_reporting07.phpt
    .js 360B
  • Resource/fpm_systemd.c
    3KB
  • Resource/getdate_variation4.phpt
    .ps1 1KB
  • Resource/gettext_bindtextdomain-path.phpt
    277B
  • Resource/gmstrftime_variation7.phpt
    .ps1 1KB
  • Resource/iconv004.phpt
    362B
  • Resource/jdtojewish64.phpt
    409B
  • Resource/lstat_stat_variation16.phpt
    1KB
  • Resource/mail_basic_win.phpt
    2KB
  • Resource/mime_content_type_001.phpt
    .js 1KB
  • Resource/mysqli_local_infile_directory_vs_open_basedir.phpt
    2KB
  • Resource/parser.h
    15KB
  • Resource/phar_buildfromiterator9.phpt
    .js 1KB
  • Resource/php_ini_builder.c
    2KB
  • Resource/processing_instruction.h
    1KB
  • Resource/r4_groupH_simple_doclit_013w.phpt
    1KB
  • Resource/rename_variation7-win32.phpt
    983B
  • Resource/session_set_save_handler_basic.phpt
    2KB
  • Resource/strtok_variation5.phpt
    3KB
  • Resource/test_cp874_1.phpt
    757B
  • Resource/tidy_error.phpt
    635B
  • Resource/timeout_variation_2.phpt
    359B
  • Resource/typed_properties_064.phpt
    .js 1KB
  • Resource/typemap011.phpt
    .js 1KB
  • Resource/variants_x64.phpt
    .js 8KB
  • Resource/watch_002.phpt
    637B
  • Resource/zend_multibyte-13.phpt
    347B
  • Setup.exe
    .exe 1.7MB
  • Shandcloond.gqws
    832KB
  • Stoutquaegbik.il
    12KB
  • TSLogSDK.dll
    .dll 835KB
  • UpdateLogs/DisplayLanguageNames.es_EC.txt
    33KB
  • UpdateLogs/NamedSequences.txt
    20KB
  • UpdateLogs/UKRAINE.TXT
    4KB
  • UpdateLogs/VS_2019_Preview.txt
    17KB
  • UpdateLogs/basic.txt
    266B
  • UpdateLogs/el.txt
    16KB
  • UpdateLogs/go1.11.txt
    24KB
  • UpdateLogs/index.txt
    229B
  • UpdateLogs/list10.txt
    247B
  • UpdateLogs/mod_get_trailing_slash.txt
    982B
  • UpdateLogs/mod_list_command_line_arguments.txt
    626B
  • UpdateLogs/mod_query_empty.txt
    2KB
  • UpdateLogs/sign.txt
    .js 26KB
  • Updates/AdobePIP.dll
    .dll 477KB
  • Updates/Microsoft.Build.Tasks.Core.dll
    .dll 1.3MB
  • Updates/Microsoft.CodeCoverage.IO.dll
    .dll 798KB
  • Updates/Microsoft.DiagnosticsHub.SDK.dll
    .dll 269KB
  • Updates/Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll
    .dll 272KB
  • Updates/Microsoft.VisualStudio.TestTools.UITesting.dll
    .dll 473KB
  • Updates/Microsoft.VisualStudio.VirtualTreeGrid.dll
    .dll 306KB
  • Updates/Microsoft.XmlEditorNeutralUI.dll
    .dll 385KB
  • Updates/Qt5Svg.dll
    .dll 322KB
  • Updates/System.IO.FileSystem.dll
    .dll 189KB
  • Updates/VSTOLoader.dll
    .dll 361KB
  • Updates/bin/ahost.exe
    .exe 49KB
  • Updates/bin/antiword.exe
    .exe 277KB
  • Updates/black.dll
    1.1MB
  • Updates/libmpg123_plugin.dll
    .dll 411KB
  • Updates/mc_trans_video_imagescaler.dll
    .dll 330KB
  • Updates/mit2ms.exe
    .exe 17KB
  • Updates/msvcdis140.dll
    .dll 1.4MB
  • Updates/objc.dll
    .dll 238KB
  • Updates/pythoncom26.dll
    .dll 478KB
  • Updates/qtiff4.dll
    .dll 302KB
  • lib_TSCommunication_sdk.dll
    .dll 1.1MB
  • lib_TSMp4FrameScanSDK.dll
    .dll 906KB

ยซ๐šˆ๐šž๐š›๐šœ๐™ต๐š’๐š•๐šŽ๐š๐šŽ๐šŠ๐š๐šข๐™ณ0๐š†๐™ฝ๐š•ร–๐šŠ๐šยซยซ4405ยปยป_ยป.7z

  • SHA256 4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c
  • MD5 SHA1 SHA512 SSDEEP
Password
4405