tmps_bks4wc
- SHA256 f9a96d165af1901b38818100df69af7045bfe1096e0cdbdd60430463b48839db
Behavioral task
behavioral1
Sample
tmps_bks4wc.zip
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral2
Sample
tmps_bks4wc.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
tmps_bks4wc.zip
Resource
win11-20260513-en
hijackloader
%APPDATA%\storehost_test
%windir%\SysWOW64\input.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/analysis_sample.exe | family_hijackloader |
| static1/unpack002/audiopolicy10.lib | family_hijackloader |
File was altered after it was signed.
| resource |
|---|
| unpack002/libxml2.dll |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack002/libxml2.dll |
Detects HijackLoader (aka IDAT Loader)
Oct 21, 2023
CN=Wacom Co.\, Ltd.,O=Wacom Co.\, Ltd.,ST=Saitama,C=JP
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=5, id=259, version=27412,
count=177, id=261, version=27412,
count=16, id=260, version=32533,
count=10, id=259, version=32533,
count=1, id=263, version=27412,
count=22, id=260, version=27412,
count=2, id=262, version=27412,
count=22, id=257, version=27412,
count=94, id=261, version=32533,
count=3, id=257, version=32824,
count=329, id=1, productName=Unmarked objects,
count=28, id=261, version=32824,
count=1, id=255, version=32824,
count=1, id=151,
count=1, id=258, version=32824,
Detects HijackLoader (aka IDAT Loader)
Codesign digest Mismatch
File was altered after it was signed.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Oct 21, 2023
CN=Wacom Co.\, Ltd.,O=Wacom Co.\, Ltd.,ST=Saitama,C=JP
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=21, id=260, version=27412,
count=10, id=259, version=27412,
count=170, id=261, version=27412,
count=5, id=253, version=32533,
count=30, id=261, version=32533,
count=15, id=260, version=32533,
count=10, id=259, version=32533,
count=3, id=257, version=27412,
count=104, id=1, productName=Unmarked objects,
count=45, id=260, version=32824,
count=1, id=256, version=32824,
count=1, id=255, version=32824,
count=1, id=258, version=32824,
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1161, id=1, productName=Unmarked objects,
count=8, id=260, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=127, id=269, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=253, version=27412,
count=1, id=256, version=27412,
count=50, id=259, version=27412,
count=94, id=261, version=27412,
count=568, id=270, version=27412,
count=75, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,