Hyper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Hyper.exe
Size 1.5MB
Sample260722-z2c8pacd79
SHA256 32101f091499086753d1f94ddf0e3d87503da533f15f4e3c3bfd20d72662aa2d
MD5 09870d615d1dbf61446200054e74b3a1
SHA1 1ccc3a0644dc4e4c1ff495811eabf9fbe83b7007
SHA512 ffe2f3f568ea3a492791301483b3fb6b423226089fee9b48bf9ce762dcf1904490226153db6723b4280c21873e124401d45460cfceee99dadf0769f2dcf75d2b
SSDEEP 24576:IEpg0Dg+aNvkAYnPOv1eE72LZnBvaUi8nhDFj0pVm4Gie+O93l0fZa:lpBTAYnPiVqhxah8nh5jR+O93+x
TLSH
T1B675AE47A2B910F9D0ABC178C6429617E7B2785913209BDF03E08A792F737E16E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hyper.exe

File Explorer

Hyper.exe

.exe 1.5MB

Hyper.exe

IMPHASH c41de906aa2e0c23878233e98feb0ddf
SHA256 32101f091499086753d1f94ddf0e3d87503da533f15f4e3c3bfd20d72662aa2d
MD5 09870d615d1dbf61446200054e74b3a1
SHA1 1ccc3a0644dc4e4c1ff495811eabf9fbe83b7007
SHA512 ffe2f3f568ea3a492791301483b3fb6b423226089fee9b48bf9ce762dcf1904490226153db6723b4280c21873e124401d45460cfceee99dadf0769f2dcf75d2b
SSDEEP 24576:IEpg0Dg+aNvkAYnPOv1eE72LZnBvaUi8nhDFj0pVm4Gie+O93l0fZa:lpBTAYnPiVqhxah8nh5jR+O93+x
TLSH
T1B675AE47A2B910F9D0ABC178C6429617E7B2785913209BDF03E08A792F737E16E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

917308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\loader\loader\x64\Release\Hyper.pdb

d3d9

Direct3DCreate9

kernel32

CreateThread HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx GetModuleFileNameA Process32Next Process32First Process32NextW Process32FirstW CreateToolhelp32Snapshot FreeConsole GetComputerNameA LoadLibraryW LoadLibraryExA VirtualFree VirtualProtect VirtualAlloc GetWindowsDirectoryW OpenProcess TerminateProcess ExitProcess GetCurrentProcess Sleep WaitForSingleObject GetLastError Beep GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId HeapReAlloc FindFirstFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId HeapSize InitializeCriticalSectionEx IsDebuggerPresent GetVolumeInformationA WriteFile ReadFile FindFirstFileA FindClose DeleteFileW GetStdHandle IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc OutputDebugStringA DeviceIoControl CloseHandle CreateFileW OutputDebugStringW HeapFree InitializeSListHead GetSystemTimeAsFileTime

user32

EmptyClipboard TrackMouseEvent MessageBoxA GetMonitorInfoW UnhookWindowsHookEx SetWindowsHookExA GetWindow GetWindowThreadProcessId EnumWindows UpdateWindow GetSystemMetrics GetClipboardData SetClipboardData CloseClipboard IsWindowVisible PostQuitMessage PostThreadMessageA PeekMessageA DispatchMessageA TranslateMessage EnumDisplayMonitors GetMonitorInfoA MonitorFromWindow LoadCursorA SetWindowLongPtrA SetWindowLongW SetWindowLongA GetWindowLongW WindowFromPoint OpenClipboard GetKeyboardLayout GetAsyncKeyState ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect GetPropA SetPropA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsWindowUnicode GetMessageExtraInfo DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW ReleaseCapture SetCapture GetCapture GetKeyState SetFocus BringWindowToTop IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsChild

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject GetDeviceCaps

advapi32

IsValidSid CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam ConvertSidToStringSidA CopySid CryptAcquireContextA OpenProcessToken GetLengthSid GetTokenInformation GetUserNameA RegQueryValueExA RegOpenKeyExA RegCloseKey CryptGenRandom

shell32

ShellExecuteW ShellExecuteA

ole32

CreateStreamOnHGlobal

msvcp140

??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Query_perf_counter _Query_perf_frequency _Thrd_detach _Thrd_join _Thrd_id _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ

wininet

InternetCloseHandle HttpSendRequestA HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetOpenA

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlImageNtHeader

psapi

GetModuleInformation

gdiplus

GdipDeleteGraphics GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipSetCompositingMode GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipAlloc GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream GdipFree

normaliz

IdnToAscii

wldap32

ord26 ord27 ord22 ord41 ord35 ord50 ord45 ord60 ord211 ord33 ord46 ord217 ord143 ord79 ord30 ord200 ord301 ord32

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CertGetCertificateChain CryptDecodeObjectEx PFXImportCertStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA

ws2_32

ntohs htons getsockopt getsockname getpeername socket bind WSAGetLastError send recv closesocket setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo ntohl gethostname recvfrom sendto connect

userenv

UnloadUserProfile

vcruntime140

__current_exception_context strrchr __C_specific_handler memcmp strstr strchr memchr __std_terminate memset memmove memcpy __std_exception_copy _CxxThrowException __std_exception_destroy __current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate _c_exit _exit _beginthreadex _initterm_e _initterm _get_narrow_winmain_command_line system _set_app_type _seh_filter_exe _invoke_watson _errno abort _cexit _invalid_parameter_noinfo_noreturn _resetstkoflw exit _invalid_parameter_noinfo strerror __sys_nerr _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _crt_atexit _register_thread_local_exe_atexit_callback _getpid

api-ms-win-crt-string-l1-1-0

isupper strspn wcscmp strncpy strcpy _strdup strncmp strcspn wcslen strlen strcpy_s strpbrk strcmp tolower _stricmp

api-ms-win-crt-heap-l1-1-0

realloc _callnewh calloc _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

setvbuf _lseeki64 _get_stream_buffer_pointers _open __stdio_common_vsscanf __stdio_common_vsprintf fwrite _fseeki64 fsetpos feof fputs fopen fclose fread _popen _close fgets _pclose __stdio_common_vfprintf __stdio_common_vsprintf_s fputc fgetpos fgetc _set_fmode fflush ungetc ftell fseek __p__commode _write _wfopen __acrt_iob_func _read

api-ms-win-crt-filesystem-l1-1-0

remove _unlink _access _unlock_file _lock_file _stat64 _fstat64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-math-l1-1-0

fmodf cosf ceilf acosf __setusermatherr sinf sqrtf _dclass

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoull strtol strtoll strtoul

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale