HoAx (1)[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HoAx (1).zip
Size 243.0MB
Sample260623-vg5pzset6m
SHA256 97b2c77f700aedeab47f308930716f283eae46067737ae2f80b788c806d0d060
MD5 0b642daf0f40d96bdb250b643340aa21
SHA1 6bb0206ce2ac909823b063d3f09fd68f3c9435bf
SHA512 cd35f94dd26832f72d7c39261b04b9ee71bb6682fd0d064e63220348830ef6011a44d58d8667287013ba5872682db03f8daaa4e6f5b8df00cdc5b1f5ca7d8eb3
SSDEEP 6291456:QnhdO3jOfbMAyZlOfyO84hrPTxfza438y5Z:GYOawh9a4N5Z
TLSH
T1AFC833EE2EB954250ABAAA277B7E9C0CA1CD3447734C879EDE6D4B0BD4530CD5708293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HoAx/HoAx.exe
unpack001/HoAx/VMProtectSDK64.dll

File Explorer

HoAx (1).zip

.zip 243.0MB
HoAx/HoAx.exe

.exe 246.7MB
HoAx/VMProtectSDK64.dll

.dll 115KB

HoAx (1).zip

SHA256 97b2c77f700aedeab47f308930716f283eae46067737ae2f80b788c806d0d060
MD5 0b642daf0f40d96bdb250b643340aa21
SHA1 6bb0206ce2ac909823b063d3f09fd68f3c9435bf
SHA512 cd35f94dd26832f72d7c39261b04b9ee71bb6682fd0d064e63220348830ef6011a44d58d8667287013ba5872682db03f8daaa4e6f5b8df00cdc5b1f5ca7d8eb3
SSDEEP 6291456:QnhdO3jOfbMAyZlOfyO84hrPTxfza438y5Z:GYOawh9a4N5Z
TLSH
T1AFC833EE2EB954250ABAAA277B7E9C0CA1CD3447734C879EDE6D4B0BD4530CD5708293
MD5 SHA1 SHA512 SSDEEP TLSH

Password

2009

HoAx/HoAx.exe

IMPHASH 88f7191a8702bafbc986ff6157f79196
SHA256 dd91e4e734ae4a80876f9292502eacaeb9f8b7f529223c6aeea7e14fd6e3e78f
MD5 a5c02cb5d72b3ab2a3d3a10ad977cab3
SHA1 5ee26a40d48c0113f3a407329f6dc65125aa7a24
SHA512 85cdc0d89aed02e22cf2cacc800546a7f48931c935910d260c9d63993cee70807d678acd384597d1afbdb849006b9c69ec0ac2b5f63b55a69da7a82b56c9a0c7
SSDEEP 6291456:kRDYb7Y3Hkk61DKZWkMCdHTL//QoNugB:kCKo+dfQoJB
TLSH
T154C833D529D482BCC4A2C535E28919FEF0C5384A4DBD892FBFCA0C027671C85F9E6976
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

2009

Minor OS version

Major OS version

Entry point

350043471

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryDataAvailable

d3dcompiler_47

D3DCompile

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetLocaleInfoA

api-ms-win-core-heap-l2-1-0

GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

GetThreadContext

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA

api-ms-win-core-file-l1-1-0

GetFileAttributesExW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-console-l1-1-0

SetConsoleMode

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask

api-ms-win-mm-time-l1-1-0

timeBeginPeriod

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-security-lsalookup-ansi-l2-1-0

LookupPrivilegeValueA

api-ms-win-core-file-l1-2-2

AreFileApisANSI

kernel32

Module32First

user32

SetWindowTextW

gdi32

GetDeviceCaps

comdlg32

GetSaveFileNameA

shell32

ShellExecuteW

ole32

CoInitialize

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

crypt32

CertFreeCertificateChainEngine

ws2_32

WSAEnumNetworkEvents

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acosf

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-runtime-l1-1-0

_wsystem

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-security-cryptoapi-l1-1-0

CryptGetHashParam

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo

Name

.text

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

486KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.?FD

Size

Virtual Size

330.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.q=v

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.n'(

Size

246.7MB

Virtual Size

246.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HoAx/VMProtectSDK64.dll

IMPHASH 1851ff453adce0cef5274e320d5bed3c
SHA256 ec3235136a4daee2a6f72c0f2994a8365ca8427c8068d068130b74c9fa64cd02
MD5 c0ce8c981bda19d2be17aca0774d9df1
SHA1 895052a42efa50043f473f072578bee69be8d2f8
SHA512 1578948dba2492263c0b174816451218c70df89e6b4440981db9513c664d97f6253fc1c0dab4164c620b9cb7794f4789677a0c38e0a5ac9636aee1dbc3d16062
SSDEEP 3072:0RcqYHq7Aiytzg2ScpvgJcLYsqYX6UDdyBo:K0Hq7AiyegZgJoZXBa
TLSH
T171C35B47B3E540BBD1B6C679CD234A56D3B678150B249BAF07A402162F233D18E3AF72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

2009

Minor OS version

Major OS version

Entry point

8864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ