looking-glass-host-setup[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
looking-glass-host-setup.exe
unpack001/looking-glass-host.exe

looking-glass-host-setup.exe

IMPHASH 8cdc6389b95ec187775657116855c929
SHA256 9d789e8e18a45aab415d40cd1fc3f07aba54e6871122f26031ac44c7250e5032
MD5 36fc0f74401e06778a338b2f0e5f467f
SHA1 982fcdfdd8401b6f5ef3e01564e863a0a9bbf4f2
SHA512 6c70624b5f64b308069d4417d4810a0429121e8fe429f6c7635b0142a0aecaca96ac0d725114754a3c5606c1e6b55ae2a9a3bc5daec63ce18f07bd4df91a9805
SSDEEP 12288:gK+vSLcDb03GZMyKhhfTQna2j123Nqlqx6ozFb8rcsb:gDSLAWGZxOfsTJWN3Q6Orcsb
TLSH
T1E3E4CDC3968A9D57D79EC334B351C3EE32906C12036BA8EB52413EDEDA7B6C8D452193
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4b:7d:aa:19:f8:47:29:97:c8:f9:bf:32:3b:f8:c4:41:50:40:e5:7e:d0:7b:aa:ab:34:ad:02:20:00:9f:34:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Chains

Mar 6, 2025

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Subject

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Serial Number

27:9d:ed:29:83:78:ac:35:2d:25:93:4e:19:97:ae:67

Issuer

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2025 - Mar 3, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Minor OS version

0

Major OS version

4

Entry point

15696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 76557808ab5a097e78f640e571eee0bfcc33f7a79c48cbbf21f9bfb724b642e0
MD5 c9b852e20fa2d242d3d9904a9abfdb09
SHA1 4bc0b5bd966d2f2e46b9adc430732169f5d545e9
SHA512 7e674596dba09c1708f914d7d47cbdd0bbcfa2b7d52e9d629d856eebe4f1869431694ccfe3559fd8fa8a763d58a24c7af863cd1cb40ce880f68ff94a44ac6672
SSDEEP 384:stLneJ5LhGcuq/eR26TesM529KGndW9BggJkf43T2uc11G1n:sVneJ5MRRDTesbw6skp9
TLSH
T16BB2FA0BB79254BED513C27881F64B71EBB2BD551A357B2E2030F6316F31E90872A558
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

400B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-wizard.bmp

SHA256 2e138faec4410e66f0b4e3199badf019bc83c1fa13f4409e8719b6762ed908be
MD5 fdc696e3785daafbcb6ac6b3ace75a56
SHA1 4d508d6c183bc3ac35eefcbb2da0d1e7a11c2f18
SHA512 8e20dcd8305e461b2fc2490a5798fe6de5749bb4884248a6c389b5792ddd642222a600afcda89d85ff792fc6b5c97ebbda5f469ab11b21be1cd6d35e86b3a46d
SSDEEP 48:btYSZmQPiZDDj/0uS82ymY2eX+8h1d4beJ8nuWtBFloJ:OSZsZDDjcuS82ymY2eX+8x4b68uWtXlc
TLSH
T10933D4C66B0B7B03CE572D795B742FB432A94E076A21983EC22860D596CCB15B740FE6
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 2a21171b63c0ee0261cd54df366503d2
SHA256 daabe44a40eed9e6b03e83d4625f8161e1edfdaa53aecfaa5cda67a423799077
MD5 b1aab309b7d969226cf1286396200002
SHA1 e366470e37a37a08eb557fa35d4a50ba2a82f4a1
SHA512 f86285df982da279f5d574829f6b7652503f73d1d6fb8409449c97b701690c2cc15b70e83ca54d261b2344923056eb78eabc66388e8b05a2fa4683ef6c56ef23
SSDEEP 384:ZRepH6exqRfuNb2x7EWKGKVlE/HpYpyKW:ZR66yWGmECvi
TLSH
T10052192F7B865269CC5EE338D0FE973267F3746A1124370D062A9F46FD91A21DB39188
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 74ba91b9fcb5a967b84ea9b49217f8d2
SHA256 1d63ae99c086e8b3d991a95d803d308117cc5323831270043491536e4b4fbd69
MD5 7bf2fc34bb5e42ad76e206f4787739b2
SHA1 2e6a59a19cb234dae36aed294f02841b6e422e82
SHA512 da1d3518f3a6949c9848c0e5eda6eb3b01a25372ec634a8bee29fc1e659ea08d383c316f0c951ee7361abc4c5225ab60ccf0ebd73925f5079f42f5c842ef877b
SSDEEP 192:iFUrkTzU6aAM8ikFKXWd3ygxhEatU4atUNvaHTY:mVTo8TFKGdxFtUntUNyHTY
TLSH
T1B332F80BFB5290EDC099E63C92FF4F177EB27C49509A273E096746164E32B90513D359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4593

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

LICENSE.txt

SHA256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643
MD5 b234ee4d69f5fce4486a80fdaf4a4263
SHA1 4cc77b90af91e615a64ae04893fdffa7939db84c
SHA512 aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957
SSDEEP 384:ghUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:gmFWixMFzMdm7jUI
TLSH
T13A82A42E770443F205C202A16A4F68DFA32AD5B9723E1155386DC15E236FE35C3BFA99
MD5 SHA1 SHA512 SSDEEP TLSH

ivshmem.cat

SHA256 40cc6242b8bf05600e5361b81ec4f5150b23bfdcbab538b68e406f8ac57e979d
MD5 cf23e9b3772771c383e65b72f3d430a0
SHA1 8220e1508c2553aaefdaaa3bd6443d08d07e5f9e
SHA512 473ccf564bc6f3e60f6b084b6bf85cdc9deccd70ab6c4bf15e7889560f90e563ab1d4aab8cfb3791ea048b51f76bfede27a2d67ab6dcf989dc5efb7231c4cf54
SSDEEP 192:J7NgtafXEwI+CYhYCG0MMBdRgjLX01k9z3AzspEI3Z:yaiMh3bleLR9zuspp3Z
TLSH
T130322AB184AC01C2FEA7BC6053F8F9573C3977CB6840852965EEFA1918973C5D72826E
MD5 SHA1 SHA512 SSDEEP TLSH

ivshmem.inf

SHA256 e41554a07eee128aee07cebdd2423dcfcde45e3868e2ae90f7ba8caf52af8f1c
MD5 5994dce4d23f9f1a952e7d212cc371fc
SHA1 8093dd0da29d238316dfe1a89140fb45c145db27
SHA512 c0809d8b6281f98cc856e26cff93becf6f30f24a927d1b007e2a50d556cd2dfd67279d2d017873dafbf83a1c862cdebd3ccaa37eb2653a1e1f7c5ea067e37cad
TLSH
T18651E04A4B1ACF3463939E27A64355C3A674708150A40058B9CEF179478FF6857DF1BA
MD5 SHA1 SHA512 TLSH

ivshmem.pdb

SHA256 c6ff65af3a759785fec1e170c9ecc25d519d46813e2b51af3ea525c028556095
MD5 dcb9f62c7b795427c9e977c58614181c
SHA1 1911857252257538d3fcdd3abb111fdf5c860f5a
SHA512 29709664b809106a805f694beb407feac73093f014474788401b6c3f7dcb2182fca9ee26e436613b05172e785571e1bf7db584b7b6d685dbee3c47318975ec6d
SSDEEP 3072:8q2cq4Pen8IO1vP8u2yyMwM+EZnpk+V8+oFYS1yHnX1TqjMnEhRJThot7HM8Xx8N:5q4Pen8IO1vV2yyXTENUHQfgK8
TLSH
T17DA43B326B187E62C47B8A7FC98B0A6E25594FC09ECD43A26B90376398F3750455CF4B
MD5 SHA1 SHA512 SSDEEP TLSH

ivshmem.sys

IMPHASH ad577173b7af4afe41d64d113816ac7b
SHA256 416c73f68f1bdaf10bdd86f2c29c62370edbdd9d3aeb109cb618eccfd050a45d
MD5 85e5f190945f081ccb31c13965330f1d
SHA1 d9b8f47f79849184139ee0a4495289863e24c77f
SHA512 194eec8564eb5e978f81d7832c2a06c49b2c4cde4bc098af14166c295e05fe88424273145d9637d8b94c560c47c22943572c1b762988b77fce97b88acb0043b4
SSDEEP 384:J+3iAMveaP691LuXSQ+rfnJE5Y4U1TiMh3IleLR9zuspd5ez:J+yAlaA1L5QKRE8Rd3qed9zui5C
TLSH
T167C26CE1D29420C2C9A7A97582F7C613BDB4B6821B1182DF40E4D4261FAB7C5EB3C71A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

ce:ca:dc:b4:6b:83:04:a7:0e:1c:40:14:e8:fa:62:15:e2:a1:de:61:29:08:da:c0:64:9e:b0:2e:5c:05:31:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 3, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

7392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\cygwin64\tmp\build\source\internal-kvm-guest-drivers-windows\ivshmem\objfre_win10_amd64\amd64\ivshmem.pdb

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

looking-glass-host.exe

IMPHASH 5a9a71f18e3f13c6ff0b198e0676d95c
SHA256 0b8383865f092794fc91204f9964aacb0870fc9cd063fbbe6b1f4d271b21239f
MD5 00c842d6d692cfe89ead7f0a7ef65398
SHA1 6c96a4b902698986c8b45748067d59e0358237bc
SHA512 5692fc0dfd27c3adbda14c8157cbd2e4b340842116f87302844db353b5762e7a234323567611e4cd8066074de4574b87979ca7bad4223e8a51d88d909936dfbe
SSDEEP 6144:fSZT+G06GzP2nfEJNznNiI697qg+0InrcVz1foloFv3bev4/RxcivOUcs8:fSsG0lycJNznNiI697qtPrQz1weMUcs8
TLSH
T1D1649297518A4CA7CB6EC334B60193FA7AA07C040323A5EB4654FCECDB37AD8D15A197
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

91:38:3c:50:04:ee:47:06:8b:2c:fe:e7:9f:03:33:7d:50:71:76:ac:ea:ab:15:7d:08:82:28:69:97:cb:07:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Chains

Mar 6, 2025

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Subject

CN=HostFission,O=HostFission,ST=Australian Capital Territory,C=AU

Serial Number

27:9d:ed:29:83:78:ac:35:2d:25:93:4e:19:97:ae:67

Issuer

CN=Sectigo Public Code Signing CA E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2025 - Mar 3, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Minor OS version

0

Major OS version

4

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\home\builder\repos\gnif\LookingGlass\build\looking-glass-host.pdb

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateServiceA DeleteService DeregisterEventSource DuplicateTokenEx GetTokenInformation LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA QueryServiceStatusEx RegGetValueA RegisterEventSourceA RegisterServiceCtrlHandlerA ReportEventA SetServiceStatus SetTokenInformation StartServiceA StartServiceCtrlDispatcherA

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsA AvSetMmThreadPriority

d3d11

D3D11CreateDevice

d3d9

Direct3DCreate9

d3dcompiler_47

D3DCompile

dbghelp

StackWalk64 SymCleanup SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize SymSetOptions

dwmapi

DwmFlush

dxgi

CreateDXGIFactory2

gdi32

D3DKMTSetProcessSchedulingPriorityClass

kernel32

AttachConsole CloseHandle CreateDirectoryA CreateEventA CreateFileA CreateFileMappingA CreateThread DeleteCriticalSection DeviceIoControl EnterCriticalSection FormatMessageA FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentVariableA GetExitCodeProcess GetLastError GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetTempPathA GetTickCount64 GetVersionExA InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA LocalFree MapViewOfFile OpenEventA QueryPerformanceCounter QueryPerformanceFrequency RegisterWaitForSingleObject ResetEvent SetConsoleCtrlHandler SetEvent SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnmapViewOfFile UnregisterWait VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fdopen _fmode _initterm _ismbblead _localtime64 _onexit _open_osfhandle _stat64 _stricmp _time64 _vscprintf _vsnprintf abort atof atol calloc exit fclose feof fflush fgetc fopen fprintf fputc free freopen fwrite isspace malloc mbstowcs memcmp memcpy memmove memset putc qsort rand realloc rename setbuf signal sprintf srand sscanf strcmp strcpy strcspn strftime strlen strncmp strncpy strrchr strstr strtok strtoul vfprintf wcscmp wcslen wcsstr wcstombs _unlink _strdup

powrprof

CallNtPowerInformation

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW Shell_NotifyIconA

shlwapi

PathCombineA PathIsDirectoryA

user32

AppendMenuA BeginPaint CallNextHookEx ChangeWindowMessageFilterEx CloseDesktop CreatePopupMenu CreateWindowExA DefWindowProcA DestroyMenu DestroyWindow DispatchMessageA DisplayConfigGetDeviceInfo EndPaint FillRect GetCursorPos GetDesktopWindow GetDisplayConfigBufferSizes GetMessageA GetMonitorInfoA GetMonitorInfoW GetSysColor KillTimer LoadCursorA LoadIconA MessageBoxA MonitorFromWindow MsgWaitForMultipleObjects OpenInputDesktop PeekMessageA PostQuitMessage QueryDisplayConfig RegisterClassA RegisterClassExA RegisterShellHookWindow RegisterWindowMessageA SendMessageA SetCursorPos SetForegroundWindow SetLayeredWindowAttributes SetThreadDesktop SetTimer SetWinEventHook SetWindowsHookExA ShowWindow TrackPopupMenu TranslateMessage UnhookWinEvent UnhookWindowsHookEx UnregisterClassA

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSQueryUserToken WTSRegisterSessionNotification WTSUnRegisterSessionNotification

ntdll

NtDelayExecution NtSetTimerResolution RtlNtStatusToDosError

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

124B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

looking-glass-host.pdb

SHA256 3103b4da638a923e0e233d1810a135685d54e1242aaf5d0b0f0bcc9f67fcb34e
MD5 bae74bbde8e296867cf10a229634a026
SHA1 76a6806926719eea34eb1a653fc22ed91c44c312
SHA512 6a23eaa2fae528cab8a2fd48450d3482ff2da5a5a051cc97aa32f0cfb07df18702b01103e72eb3b541b9c7534c6ca060cc95e2a31b4515dcad26485ad760b307
SSDEEP 6144:AitC3TQCAZ4az2TTFlWabthdxOg65/5P8io3cfLa5zKmzLkR1U37e7aOTvf2Zz4Y:AJ1Qqzus1OTC4pjo
TLSH
T19ED4C463BBA49E63C42B4A3D8E670F1866ECEB8CEFD5D34A4344731D4CD63185D29A84
MD5 SHA1 SHA512 SSDEEP TLSH

uninstaller.exe.nsis

SHA256 2e62f804e2d73121cd7eb82c1097208837a627a04d4a769328a3f82abfbff946
MD5 42bd5289bc8bc5ace986d343c37bb794
SHA1 740059cf6987259772edc9d3e49a54cf23b4b85b
SHA512 513a2fcac61fa8e5a0bd4a2a79115eb69cbcfcb9206e3538978a6f210c8118022ad76d7322a4fa98b0fceaf65f6fd6f20867ebda5a75f830db0fd749270880bc
SSDEEP 96:CQaJJcDO/tbyD/GL+l/932EQXFcKGQtywFdOmlpl/cYyazBqvSwOpkCXlf:gF2B941cKGQplrc7eB3wpCp
TLSH
T118D19DCD3957664145857CF20FFE1D9C3A7DC6382B9087038A757FF9A0A1B0180696A3
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

looking-glass-host-setup.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

comdlg32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

kernel32

user32

generic

LICENSE.txt

ivshmem.cat

ivshmem.inf

ivshmem.pdb

ivshmem.sys

ntoskrnl.exe

wdfldr.sys

generic

looking-glass-host.exe

PE Signature issue

advapi32

avrt

d3d11

d3d9

d3dcompiler_47

dbghelp

dwmapi

dxgi

gdi32

kernel32

msvcrt

powrprof

rpcrt4

setupapi

shell32

shlwapi

user32

userenv

wtsapi32

ntdll

generic

looking-glass-host.pdb

uninstaller.exe.nsis