hook64[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hook64.dll
Size 49KB
Sample260620-ytrwfahs8p
SHA256 75cb6860a9d974dbad5c3f03269b44f3e81d1a6983a63f87972dbe3efff5d222
MD5 d189baf178a6fbca5ee9b75890d35119
SHA1 0b042e93762fc5bd805e8aea6f3639bdb888c7a9
SHA512 e450f932dd5f7d9bbfc68ad1d66ab90919830b66f5caa61b40140ce8274f03026de1a72c99cf8504e2225c9528b004e0950e6fd1e3628a74c1d6bfb973754bb1
SSDEEP 1536:/VpNe24mrGpovbPEufcIyOGlvQfV+IDSnTBmetM:Npg24mrLPEufcIyOGlvQfV+IDSnTBmeu
TLSH
T1BE334B866B0520E8C152C07ECE2142B7E372B82A033D66FFB7DC89394F656E5E139756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hook64.dll

File Explorer

hook64.dll

.dll 49KB

hook64.dll

IMPHASH 56d38436949c26880f6431554bb4e036
SHA256 75cb6860a9d974dbad5c3f03269b44f3e81d1a6983a63f87972dbe3efff5d222
MD5 d189baf178a6fbca5ee9b75890d35119
SHA1 0b042e93762fc5bd805e8aea6f3639bdb888c7a9
SHA512 e450f932dd5f7d9bbfc68ad1d66ab90919830b66f5caa61b40140ce8274f03026de1a72c99cf8504e2225c9528b004e0950e6fd1e3628a74c1d6bfb973754bb1
SSDEEP 1536:/VpNe24mrGpovbPEufcIyOGlvQfV+IDSnTBmetM:Npg24mrLPEufcIyOGlvQfV+IDSnTBmeu
TLSH
T1BE334B866B0520E8C152C07ECE2142B7E372B82A033D66FFB7DC89394F656E5E139756
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetEnvironmentVariableA SetEnvironmentVariableA CreateDirectoryA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA WriteFile IsDebuggerPresent OutputDebugStringA CloseHandle GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject GetCurrentProcess GetExitCodeThread FlushInstructionCache OpenProcess VirtualProtect VirtualQuery DisableThreadLibraryCalls GetModuleFileNameA GetModuleHandleA GetProcAddress K32GetModuleFileNameExA CreateToolhelp32Snapshot Process32First Process32Next InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter

shlwapi

PathRemoveFileSpecA StrStrIA

shell32

SHGetFolderPathA

vcruntime140

__C_specific_handler memcpy __std_type_info_destroy_list memset memchr strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler _errno _beginthreadex _cexit _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_stricmp strtok_s strncpy_s strncmp strpbrk strlen _strnicmp

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsnprintf_s __stdio_common_vfprintf fopen_s __stdio_common_vsscanf fflush _fsopen fgets