AhootMacro[.]exe | Triage™

Resubmissions

27/06/2026, 15:52

260627-ta3rdacs3n3

27/06/2026, 15:46

260627-s7l98ab18q8

Sharing

Copy URL Twitter E-mail

General

Target
AhootMacro.exe
Size 997KB
Sample260627-ta3rdacs3n
SHA256 8f012e142f5ddcadb0f66f7a14914fd7dca1554eeae985aed3d2fb232c688d72
MD5 4e6a8e6dbd338da1919c648464d57b81
SHA1 56e89be2b6aaffd3d90f2a5ecfc6a610f84d78cd
SHA512 31eaf43d9fab9541602917116fb542bff06938e95322978ebb5511818b325bafcccc94856b9a935138f04c33facd31874a18adde372e4cfe29d4a7c7cd02f280
SSDEEP 24576:tLJhayGI6QeR73/bX6vpT9phcXJpCVXXoz5v5ML2f1ijd0cL:Le13Cph9un9f0p0
TLSH
T13E25AD5D63B400FCE0B6D5B8CD439A17EB72B80647309A9B07E59A491F637704A7FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AhootMacro.exe

File Explorer

AhootMacro.exe

.exe 997KB

AhootMacro.exe

IMPHASH c084c946449691133a64af661fdf9c5f
SHA256 8f012e142f5ddcadb0f66f7a14914fd7dca1554eeae985aed3d2fb232c688d72
MD5 4e6a8e6dbd338da1919c648464d57b81
SHA1 56e89be2b6aaffd3d90f2a5ecfc6a610f84d78cd
SHA512 31eaf43d9fab9541602917116fb542bff06938e95322978ebb5511818b325bafcccc94856b9a935138f04c33facd31874a18adde372e4cfe29d4a7c7cd02f280
SSDEEP 24576:tLJhayGI6QeR73/bX6vpT9phcXJpCVXXoz5v5ML2f1ijd0cL:Le13Cph9un9f0p0
TLSH
T13E25AD5D63B400FCE0B6D5B8CD439A17EB72B80647309A9B07E59A491F637704A7FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

579620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

wininet

HttpOpenRequestA InternetSetOptionA InternetOpenA InternetCloseHandle HttpQueryInfoA HttpSendRequestA InternetConnectA InternetOpenUrlA InternetReadFile

iphlpapi

GetAdaptersInfo

shell32

ShellExecuteA ShellExecuteW

ntdll

RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind

kernel32

LoadLibraryA GetProcAddress ExitProcess GetVolumeInformationA GetCurrentProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleFileNameA Module32FirstW GetCurrentProcessId GetProcessHeap Module32NextW GetTickCount GetComputerNameA OutputDebugStringA WideCharToMultiByte GetSystemTime VirtualProtect K32GetModuleInformation QueryPerformanceCounter FindClose GetSystemTimeAsFileTime GetCurrentThread GetThreadContext MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReadFile QueryPerformanceFrequency GetLastError FreeLibrary InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW ExitThread CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId GetSystemTimePreciseAsFileTime SetLastError CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetModuleHandleW Sleep GetCommandLineA SetErrorMode FreeEnvironmentStringsW GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW HeapReAlloc GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP CreateThread FlsAlloc FlsGetValue FlsSetValue IsProcessorFeaturePresent SetEnvironmentVariableW RaiseException GetModuleHandleA IsDBCSLeadByte GetModuleFileNameW GetStdHandle WriteFile UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW SetStdHandle CreateFileW HeapSize WriteConsoleW GetCPInfo FreeLibraryAndExitThread SetEndOfFile GetLocaleInfoA GetEnvironmentStringsW GetCommandLineW SetConsoleCtrlHandler GetModuleHandleExW TerminateProcess FlsFree

user32

GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW GetMessageW FillRect WindowFromDC SetLayeredWindowAttributes SetWindowLongW GetClientRect InvalidateRect BeginPaint EndPaint GetDC FindWindowA CallNextHookEx GetCapture FindWindowW DefWindowProcW GetKeyState PostMessageW GetWindowRect DestroyWindow IsWindowVisible SetWindowLongPtrW CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW BringWindowToTop TranslateMessage LoadIconW LoadCursorW PostQuitMessage UpdateWindow SetForegroundWindow GetCursorPos PeekMessageW MessageBoxA TrackMouseEvent GetAsyncKeyState GetMessageExtraInfo ReleaseDC ClientToScreen

gdi32

DeleteObject CreateSolidBrush GetPixel

advapi32

GetUserNameA CryptGenRandom CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryValueExA RegOpenKeyExA

ws2_32

gethostname freeaddrinfo getaddrinfo inet_ntop

gdiplus

GdiplusStartup GdiplusShutdown GdipDeleteBrush GdipDrawEllipseI GdipSetSmoothingMode GdipCreateSolidFill GdipCreateFromHDC GdipFillEllipseI GdipCreatePen1 GdipFillRectangleI GdipDeleteGraphics GdipDeletePen

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

765KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

AhootMacro.exe

d3d11

d3dcompiler_47

dwmapi

wininet

iphlpapi

shell32

ntdll

kernel32

user32

gdi32

advapi32

ws2_32

gdiplus

imm32

generic