hookWord321573776245705159600[.]dll

General

Target
hookWord321573776245705159600.dll
Size 201KB
Sample260727-aj3m7ashrf
SHA256 6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139
MD5 8b80886400f63d27bbebfff16e3578e0
SHA1 f051e85c6d4387bb75727233fcbeaf0b029a3e6a
SHA512 4262a4a9d811c4e30d80510f33ca19633ac9b6a11d092196b924da85b0ee086afe702414c46f6f9eff65ffdb5c7083d07a7964be36f6d5c6961c37ca6c276c4b
SSDEEP 3072:T/8ZWvLlpCo5jd2eooZBDD9Q1m1Jbr1HQXlrkPebZOARk5apiI:T/9+kjkeouDD9J11wX1ZbZOAFpV
TLSH
T133148D01B641C133CABB067595BE87ADA77CAA710B5890C7F3DC4D7A9F606D17A3220B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
hookWord321573776245705159600.dll

File Explorer

hookWord321573776245705159600.dll

.dll 201KB

hookWord321573776245705159600.dll

IMPHASH 321377a0a8106ba1a39fd4e818628ebd
SHA256 6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139
MD5 8b80886400f63d27bbebfff16e3578e0
SHA1 f051e85c6d4387bb75727233fcbeaf0b029a3e6a
SHA512 4262a4a9d811c4e30d80510f33ca19633ac9b6a11d092196b924da85b0ee086afe702414c46f6f9eff65ffdb5c7083d07a7964be36f6d5c6961c37ca6c276c4b
SSDEEP 3072:T/8ZWvLlpCo5jd2eooZBDD9Q1m1Jbr1HQXlrkPebZOARk5apiI:T/9+kjkeouDD9J11wX1ZbZOAFpV
TLSH
T133148D01B641C133CABB067595BE87ADA77CAA710B5890C7F3DC4D7A9F606D17A3220B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

75:a3:b6:61:3e:a3:3e:18:c2:e5:ed:f1:be:da:49:4b

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,OU=Product Dept.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,OU=Product Dept.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

2b:bc:65:35:2c:d1:db:b2:ed:61:49:2a:f8:cb:a5:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2018 - Oct 22, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

5

Entry point

90740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Program Files (x86)\Jenkins\workspace\branches6.10\src\bin\Release\hookWord32.pdb

kernel32

CreateFileA ReadFile LoadLibraryA FlushFileBuffers SetStdHandle GetConsoleOutputCP WriteConsoleA SetFilePointer InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA GetLocaleInfoA GetProcAddress LoadLibraryW GetCurrentProcess GetProcessId GetModuleFileNameW MultiByteToWideChar WriteConsoleW WideCharToMultiByte HeapReAlloc VirtualAlloc HeapSize GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess GetModuleFileNameA GetStdHandle CloseHandle GetConsoleMode GetConsoleCP WriteFile IsValidCodePage GetOEMCP InterlockedIncrement InterlockedDecrement Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetLastError HeapFree HeapAlloc RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetModuleHandleA

user32

SetWindowPos FindWindowExW GetFocus GetAsyncKeyState GetDC DestroyWindow PostMessageW ShowWindow KillTimer SetTimer GetWindowLongW CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx LoadCursorW RegisterClassExW DefWindowProcW GetSystemMetrics CreateWindowExW SetWindowLongW ReleaseDC GetWindowRect GetWindowRgn IsWindow BringWindowToTop

gdi32

CreateRectRgn SelectObject CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC GetDeviceCaps GetRgnBox

gdiplus

GdipDeleteBrush GdipFree GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreatePen1 GdipDeletePen GdipStringFormatGetGenericTypographic GdipCreateFromHDC GdipDeleteGraphics GdipDrawLineI GdipDrawString GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipLoadImageFromFile GdipCloneImage GdiplusStartup GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipGetImageWidth GdipGetImageHeight GdipAlloc

Sharing

General

Malware Config

Signatures

File Explorer

hookWord321573776245705159600.dll

PE Signature issue

kernel32

user32

gdi32

gdiplus

generic