HitmanPro_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HitmanPro_x64.exe
Size 9.3MB
Sample260628-aj5sjset3s
SHA256 1c4c3fda84181b8df61727edf1be44b62656f0f7e4e2ac997541f619b3b2840f
MD5 e83007029d7fd71dbef425eba3c7eceb
SHA1 d78e05eaa324ae25d74850d99feaf073fc1c2d73
SHA512 4c810532b9827cbda8fcd4a65d3f8b605b4338a2ef6b6f22762d7dea7b0edac6940f989e6cd11c7935ff5f9f7810e90886ff855ef5423f3cc8a0a63b3491db71
SSDEEP 98304:mVmNSZ0KgAY4nVSU8Vv9Cg1JXgx7UPmX3+PKz8Bu4UxTyZAHxjugR/9/:mVmNS/rY+Cv9/1NrmUsxGZcxScp
TLSH
T173A68C1377F90094F1B796389AB68222DA73BC414B38C6DF119A560E5FB3EE18D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
HitmanPro_x64.exe

File Explorer

HitmanPro_x64.exe

.exe 9.3MB

HitmanPro_x64.exe

IMPHASH f8e8087ecad219e8a7614ab1aaa25912
SHA256 1c4c3fda84181b8df61727edf1be44b62656f0f7e4e2ac997541f619b3b2840f
MD5 e83007029d7fd71dbef425eba3c7eceb
SHA1 d78e05eaa324ae25d74850d99feaf073fc1c2d73
SHA512 4c810532b9827cbda8fcd4a65d3f8b605b4338a2ef6b6f22762d7dea7b0edac6940f989e6cd11c7935ff5f9f7810e90886ff855ef5423f3cc8a0a63b3491db71
SSDEEP 98304:mVmNSZ0KgAY4nVSU8Vv9Cg1JXgx7UPmX3+PKz8Bu4UxTyZAHxjugR/9/:mVmNS/rY+Cv9/1NrmUsxGZcxScp
TLSH
T173A68C1377F90094F1B796389AB68222DA73BC414B38C6DF119A560E5FB3EE18D35722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e1:c1:04:41:ca:c5:95:46:d0:15:15:95:25:e4:36:a6:57:6e:c2:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SurfRight B.V.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SurfRight B.V.,L=Hengelo,ST=Overijssel,C=NL

Chains

Apr 4, 2013

CN=SurfRight B.V.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SurfRight B.V.,L=Hengelo,ST=Overijssel,C=NL

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=SurfRight B.V.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SurfRight B.V.,L=Hengelo,ST=Overijssel,C=NL

Serial Number

34:a8:b1:9d:c8:07:1e:41:82:fb:27:f9:b7:ec:72:2a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2012 - Jan 5, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1794208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x64\Release MT\HitmanPro_x64.pdb

kernel32

GetLastError WaitForMultipleObjects CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObject WaitForSingleObjectEx CreateWaitableTimerW SetWaitableTimer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread SignalObjectAndWait TerminateThread LocalAlloc LocalFree LoadLibraryW GetProcAddress QueryPerformanceFrequency SetThreadPriority GetCurrentThread QueryPerformanceCounter GetProcessHeap HeapFree HeapAlloc HeapReAlloc SystemTimeToFileTime LocalFileTimeToFileTime CompareFileTime GetLocalTime GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource OutputDebugStringW FileTimeToSystemTime GetCalendarInfoW SetLastError GetWindowsDirectoryW FormatMessageW FileTimeToLocalFileTime GetSystemTimeAsFileTime GetLocaleInfoW GetTempPathW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetModuleHandleA GetCurrentProcess RegisterWaitForSingleObject UnregisterWaitEx PeekNamedPipe FlushFileBuffers DisconnectNamedPipe ReadFile GetOverlappedResult WriteFile CreateFileW WaitNamedPipeW LoadLibraryA GetComputerNameW GetFileAttributesExW GetFileTime SetFileTime GetVersion ResumeThread Sleep GetCommandLineW CreateProcessW ConvertDefaultLocale GetFileSizeEx GetLogicalDriveStringsW QueryDosDeviceW GetSystemDirectoryW SetThreadAffinityMask GetTickCount DeleteFileW OpenProcess GetModuleFileNameW GetCurrentThreadId SetErrorMode DeviceIoControl GetStdHandle GetDriveTypeW GetVolumeInformationW GetFileSize SetFileAttributesW GetCurrentProcessId TerminateProcess GetNumberFormatW GetVersionExW FreeLibrary GetSystemInfo WTSGetActiveConsoleSessionId ProcessIdToSessionId GetProcessTimes GlobalAlloc OpenEventW CopyFileW AllocConsole MultiByteToWideChar SetUnhandledExceptionFilter SearchPathW OpenThread DuplicateHandle CreateSemaphoreW ReleaseSemaphore GetEnvironmentVariableW GetVolumeInformationA ExpandEnvironmentStringsW SuspendThread SetHandleInformation VirtualAlloc VirtualFree CreateNamedPipeW ConnectNamedPipe WideCharToMultiByte GetThreadPriority GetSystemWow64DirectoryW GetLongPathNameW VirtualQueryEx ReadProcessMemory VirtualAllocEx VirtualFreeEx RaiseException MoveFileW GlobalFree GetCurrentDirectoryW GetCurrentDirectoryA SetEndOfFile SetFilePointerEx FormatMessageA GetFullPathNameW GetFullPathNameA CreateFileA SetFilePointer MapViewOfFile UnmapViewOfFile UnlockFile LockFile UnlockFileEx GetFileAttributesA LockFileEx GetDiskFreeSpaceW CreateFileMappingW GetDiskFreeSpaceA GetTempPathA GetSystemTime AreFileApisANSI DeleteFileA ExitProcess lstrlenA EncodePointer DecodePointer ReadConsoleInputA SetConsoleMode GetConsoleMode GetFileType GetConsoleCP GetStartupInfoW RtlUnwindEx RtlPcToFileHeader UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation HeapCreate HeapSize LCMapStringW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount SetHandleCount SetStdHandle WriteConsoleW GetTimeZoneInformation CompareStringW SetEnvironmentVariableW SetEnvironmentVariableA VirtualLock VirtualUnlock Heap32ListNext Heap32Next Heap32First Heap32ListFirst Thread32Next Thread32First Process32Next Process32First Module32Next Module32First CreateToolhelp32Snapshot GlobalMemoryStatus VirtualQuery VirtualProtect GetThreadContext SetThreadContext

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

855KB

Virtual Size

854KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HitmanPro_x64.exe

PE Signature issue

kernel32

generic