tungtunghook[.]exe

General

Target
tungtunghook.exe
Size 136KB
Sample260701-p74mqaex5p
SHA256 ddb712e5133257d6863ad3b7b53d93a5e307a02ad0857bc230e271f6c30ed2e7
MD5 a5ed8e55aa615bbbfa3bd76dfccf7f7e
SHA1 41051841b50a0dcff004de01577fae9e2cd16f30
SHA512 ab3d4e26ec43774b85bdbcf54bc521e7116c348a230293609b2592726f0f2fb6ab0cbe716745224373697ed903d106459e2828015ef31cb6654e501317b38ed6
SSDEEP 3072:KVU0B9tu3YR3+uem9jR0e47W/3/GuK16mLXO9MSLK9OgDs4/IFWD0d:KVU0B9tu3Y1+uj4e47v16mDOa19TsfFN
TLSH
T1F7D36B5BB3E530F8E177C279C9914A05E772B8750B619BDF07A042A61F236E09D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tungtunghook.exe

File Explorer

tungtunghook.exe

.exe 136KB

tungtunghook.exe

IMPHASH 23c0331bca0169dce9a74f7a5f0af3b1
SHA256 ddb712e5133257d6863ad3b7b53d93a5e307a02ad0857bc230e271f6c30ed2e7
MD5 a5ed8e55aa615bbbfa3bd76dfccf7f7e
SHA1 41051841b50a0dcff004de01577fae9e2cd16f30
SHA512 ab3d4e26ec43774b85bdbcf54bc521e7116c348a230293609b2592726f0f2fb6ab0cbe716745224373697ed903d106459e2828015ef31cb6654e501317b38ed6
SSDEEP 3072:KVU0B9tu3YR3+uem9jR0e47W/3/GuK16mLXO9MSLK9OgDs4/IFWD0d:KVU0B9tu3Y1+uj4e47v16mDOa19TsfFN
TLSH
T1F7D36B5BB3E530F8E177C279C9914A05E772B8750B619BDF07A042A61F236E09D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

23492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage LoadCursorW GetDesktopWindow FillRect ScreenToClient MessageBoxW GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DrawTextW ReleaseCapture SetCapture SetWindowPos ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW GetMessageW

gdi32

MoveToEx SetTextColor SetBkMode SelectObject RoundRect LineTo GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

kernel32

GetFileType GetProcessHeap LCMapStringW SetStdHandle GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW EnterCriticalSection Beep MulDiv RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError LeaveCriticalSection DeleteCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

Name

.text

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tungtunghook.exe

user32

gdi32

kernel32

generic