brokerfoundation_x86.zip
- SHA256 c3cacea1d8117f1465079b670feb28620a2e5316113296b097f9f9d219e52165
Overview
overview
10Static
static
10brokerfoun...32.exe
windows10-2004-x64
10brokerfoun...32.exe
windows11-21h2-x64
10brokerfoun...te.dll
windows10-2004-x64
3brokerfoun...te.dll
windows11-21h2-x64
3brokerfoun...in.dll
windows10-2004-x64
3brokerfoun...e3.dll
windows10-2004-x64
3brokerfoun...e3.dll
windows11-21h2-x64
3brokerfoun...se.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
brokerfoundation_x86/Termin-Distributed32.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
brokerfoundation_x86/Termin-Distributed32.exe
Resource
win11-20250610-en
Behavioral task
behavioral3
Sample
brokerfoundation_x86/datastate.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
brokerfoundation_x86/datastate.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
brokerfoundation_x86/msvcp_win.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
brokerfoundation_x86/sqlite3.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral7
Sample
brokerfoundation_x86/sqlite3.dll
Resource
win11-20260130-en
Behavioral task
behavioral8
Sample
brokerfoundation_x86/ucrtbase.dll
Resource
win10v2004-20260130-en
hijackloader
%APPDATA%\brokerfoundation_x86
%windir%\SysWOW64\input.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/brokerfoundation_x86/particleimpl28.toml | family_hijackloader |
File was altered after it was signed.
| resource |
|---|
| unpack001/brokerfoundation_x86/datastate.dll |
| unpack001/brokerfoundation_x86/sqlite3.dll |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/brokerfoundation_x86/sqlite3.dll |
| unpack001/brokerfoundation_x86/datastate.dll |
Aug 2, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Aug 2, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Codesign digest Mismatch
File was altered after it was signed.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
May 12, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
May 12, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=150, version=20413,
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=77, id=131, productName=VS2008 build 21022, version=21022,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=38, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1204, id=1, productName=Unmarked objects,
count=8, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=127, id=269, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
Detects HijackLoader (aka IDAT Loader)
Codesign digest Mismatch
File was altered after it was signed.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
May 12, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
May 12, 2022
SERIALNUMBER=91510107MA654N9046,CN=Chengdu ShanHe Information Technology Co.\, Ltd.,O=Chengdu ShanHe Information Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e5775686f75204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=27412,
count=1, id=256, version=27412,
count=110, id=259, version=27412,
count=93, id=261, version=27412,
count=619, id=270, version=27412,
count=21, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,