Hookx External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Hookx External.exe
Size 1.6MB
Sample260714-ya59qaey8x
SHA256 bd99d9d4edb88e70a71f0812973478012ac365734a3a6a1c441f3d6cddc5f498
MD5 2e17603df9d72ea719f472767bd22702
SHA1 281c6c80bbb9d28688448ad41fb0221e0fe1f09e
SHA512 e9319736c3579c8ff970e928ce8874ad97fb7a94204d6c5f5764ec2932c8f50d0717ddd935cb45100310a457b672695b607fc5b90f2ee57a6b3b7184df7bee88
SSDEEP 49152:AF2MFytxXmfCwXUDIq/NbaBnULOkNNtUs:Y8KXUDIOiMf
TLSH
T15275CF57B2F641ECC2BBD178C246AB1BEB71340903209BDB27E44A596F53BE01B7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hookx External.exe

File Explorer

Hookx External.exe

.exe 1.6MB

Hookx External.exe

IMPHASH b1f7c04144de339d14522261f2d1bb03
SHA256 bd99d9d4edb88e70a71f0812973478012ac365734a3a6a1c441f3d6cddc5f498
MD5 2e17603df9d72ea719f472767bd22702
SHA1 281c6c80bbb9d28688448ad41fb0221e0fe1f09e
SHA512 e9319736c3579c8ff970e928ce8874ad97fb7a94204d6c5f5764ec2932c8f50d0717ddd935cb45100310a457b672695b607fc5b90f2ee57a6b3b7184df7bee88
SSDEEP 49152:AF2MFytxXmfCwXUDIq/NbaBnULOkNNtUs:Y8KXUDIOiMf
TLSH
T15275CF57B2F641ECC2BBD178C246AB1BEB71340903209BDB27E44A596F53BE01B7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1064672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hoode\Desktop\vsc\Hookx External\Build\Hookx External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xbad_alloc@std@@YAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

gdi32

GetDIBits GetObjectA GetDeviceCaps DeleteObject

dwmapi

DwmExtendFrameIntoClientArea

user32

ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadImageA MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow GetIconInfo GetSystemMetrics ShowWindow SetWindowLongA SetWindowDisplayAffinity GetCursorPos DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage SendMessageA LoadIconA PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow mouse_event GetAsyncKeyState FindWindowA SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC MessageBoxA

kernel32

IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW IsDebuggerPresent CreateFileW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetConsoleWindow SetConsoleTitleA Module32NextW VirtualAllocEx Module32FirstW CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess GetProcessId GetComputerNameA CreateDirectoryA ExitProcess GetVolumeInformationA GetCurrentThread GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FindClose CreateFileMappingA SetThreadPriority Sleep GetConsoleMode SetConsoleMode GetStdHandle GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest

advapi32

GetUserNameA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr strchr strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception _CxxThrowException __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _set_app_type terminate _register_thread_local_exe_atexit_callback _c_exit system __p___argv __p___argc _exit exit _beginthreadex _initterm_e _errno _initterm _get_initial_narrow_environment _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort

api-ms-win-crt-math-l1-1-0

_fdclass cosf acosf ceilf __setusermatherr nearbyint logf log pow powf fmodf sinf sqrtf roundf

api-ms-win-crt-stdio-l1-1-0

fseek fflush __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf __stdio_common_vsscanf fread fgetpos fwrite __p__commode __stdio_common_vfprintf _wfopen _set_fmode fgetc __stdio_common_vsprintf fputc __stdio_common_vsprintf_s fclose

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strcmp tolower strcpy_s isalnum _wcsicmp strncmp strncpy strncpy_s

api-ms-win-crt-convert-l1-1-0

strtol strtof atof

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func