hamzee[.]bat | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hamzee.bat
Size 5.7MB
Sample260620-v97eaahv51
SHA256 6daf6d3311f082d91fb5bcbfe90e3c3292a65936b971a9563cf024135a9b693a
MD5 ada81052fdc3c5a45a94880370e70011
SHA1 9a919b3e1c39247cd06cd90dcc6115c4b896805d
SHA512 20fa589567e3ea2512626214ffd00928750adb9b6afb197e655366a2dbac7ef003d3e29bef992cbf4822bb63af5518ec9a0161a10a208b686b27d0a36c42365f
SSDEEP 98304:74TBNgdpgDu+5Fm6/9I12b5pFdrUfc6SSIYU0ixAwRl+gSiqJI+qUq:8TB6dpgDu+5Fm6/9Igb5pW1NIYGCY+M6
TLSH
T196568C02EA471AB4F6125C3B8D7D7B16C221B2D61E231BDB7E7CCF0D6B51AE06965B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hamzee.bat

File Explorer

hamzee.bat

.exe 5.7MB

hamzee.bat

IMPHASH d82ede9016b11d3ed9f63e3df67a7705
SHA256 6daf6d3311f082d91fb5bcbfe90e3c3292a65936b971a9563cf024135a9b693a
MD5 ada81052fdc3c5a45a94880370e70011
SHA1 9a919b3e1c39247cd06cd90dcc6115c4b896805d
SHA512 20fa589567e3ea2512626214ffd00928750adb9b6afb197e655366a2dbac7ef003d3e29bef992cbf4822bb63af5518ec9a0161a10a208b686b27d0a36c42365f
SSDEEP 98304:74TBNgdpgDu+5Fm6/9I12b5pFdrUfc6SSIYU0ixAwRl+gSiqJI+qUq:8TB6dpgDu+5Fm6/9Igb5pW1NIYGCY+M6
TLSH
T196568C02EA471AB4F6125C3B8D7D7B16C221B2D61E231BDB7E7CCF0D6B51AE06965B00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

850320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glScissor glPolygonMode glIsEnabled glEnable glDrawElements glDisable glBlendFunc wglGetProcAddress wglGetCurrentDC glGetString glGetIntegerv glClear glClearColor glViewport glTexImage2D glPixelStorei glTexParameteri glDeleteTextures glBindTexture glGenTextures

winmm

PlaySoundA PlaySoundW

shell32

Shell_NotifyIconW DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles

kernel32

CloseHandle WaitForSingleObjectEx HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA Sleep GetModuleHandleA FindResourceA GetModuleHandleW LockResource LoadResource SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState MultiByteToWideChar VerSetConditionMask GetLastError FreeLibrary GetProcAddress LoadLibraryA FormatMessageW WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP FlushFileBuffers OutputDebugStringW HeapReAlloc ReadConsoleW GetConsoleMode SetFilePointerEx HeapFree HeapAlloc LCMapStringW WriteFile ExitProcess ReadFile WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW EncodePointer SetLastError RaiseException InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetCurrentThreadId InitializeCriticalSectionEx SetEndOfFile

user32

SetWindowPlacement GetRawInputDeviceList GetRawInputDeviceInfoA EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData MonitorFromWindow SystemParametersInfoW LoadImageW DestroyIcon LoadCursorW SetWindowLongW GetWindowLongW PtInRect SetRect ClipCursor WindowFromPoint ClientToScreen SetCursor AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW RedrawWindow ReleaseDC GetDC ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed BringWindowToTop IsIconic GetMonitorInfoW GetWindowPlacement SetWindowPos SetLayeredWindowAttributes DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW WaitMessage GetMessageTime PeekMessageW TrackMouseEvent CallWindowProcW GetWindowLongA PostQuitMessage SetForegroundWindow ShowWindow GetWindowRect ScreenToClient TrackPopupMenu LoadStringW AppendMenuA CreatePopupMenu LoadIconW LoadIconA SetWindowLongPtrW GetKeyNameTextA GetAsyncKeyState DispatchMessageW TranslateMessage GetMessageW SetWindowsHookExA SetCursorPos SendMessageW GetCursorPos GetForegroundWindow CallNextHookEx EnumWindows GetWindowTextA GetWindowThreadProcessId IsWindowVisible

gdi32

CreateRectRgn DeleteObject SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat SetDeviceGammaRamp CreateDCW GetDeviceCaps DeleteDC

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

ntdll

RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlVirtualUnwind RtlUnwindEx RtlCaptureContext

Name

.text

Size

983KB

Virtual Size

982KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

513KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hamzee.bat

opengl32

winmm

shell32

kernel32

user32

gdi32

imm32

ntdll

generic