5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260728-sz2pyaygnf
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1
- Target
  Compiler/include/wil/windowing.h
- Size 5KB
- SHA256 1a998285702f7fe94c5c4173d469a209b04555dbae3c5bec7162d68b8a7a138c
- MD5 af05d6d951339159040c6e90b4baeeed
- SHA1 cf0222d8e1225c1d65351cd9e55d11383f0e6ae3
- SHA512 1ceedf7a24fd29e86c9799de89841fcf0b6736cc03257fb70ff8589ca62f29a682cc48da1286d4e78f45bf91c73563fa99c3736eaecedf22f403398859270799
- SSDEEP 48:0C8QHFs0L7PBCilMHoBnkwE6HObkRTzMfUMXoJnUwQ/5PBFjxZ4Ux5+PBad49mBd:0C8QH9PBFooBbxBz4oJLQhz/Uce6noBG
- TLSH
  T151C10D4420376FA60DB1DFBA8605A3D1E62F64430F6F0612709DB3A16FFE5228399DC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Compiler/x86_64-w64-mingw32/bin/libc++.dll
- Size 2.0MB
- SHA256 74c541f76732d738642072e90f26343e44d66d97bb258db76f2f3bee7e30060c
- MD5 c8c00080c39825ffa74538fa15ff8000
- SHA1 f64e9091821a92d88c67f890d2b2a4311b066d7e
- SHA512 015c41ad8012255169772a21c629d8b7872f3b5ae3a318b54d879e4e078ebc349db85b38b636e0d44b63461e48916927d9956eff13bb2f038f8846d501f063e4
- SSDEEP 24576:tCVr3dvcA1YczEni9PzCaLrrAUpshSMXl2hTdR7l5SLujr+w4gCxSJBpKcKF5itY:41YczEniJCarrtfJBpKc2
- TLSH
  T11AA56C03A3E6CE5AC89EBB7491C7271AB334BD5117F75ADB521053206E837C99A3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Compiler/x86_64-w64-mingw32/bin/libunwind.dll
- Size 211KB
- SHA256 6e6d1e74d17ee361b3f3661faa3d07fa7597257df1cd3dd360719222e54aa36c
- MD5 30a2d4c1be541c3e7b15f25b07f710b3
- SHA1 6039918e2df8935ba3e8c8811d39855ef7824cb3
- SHA512 05e5e1926052000138bf87dc76020fc6a868da102b9978c9ba75766fed764f5b490b09d4195f8234778c82c7ae0c91ac43723c00af6cc60991252656087d8aae
- SSDEEP 1536:B/OQPJIbKEP1Qs7WdfVf/HrJW5hsfhmMHU3jXvLmbAY2j8SCmQ2FIeXi2MIL80Yl:B/OQPJIbj1lydtXavKwBl3FvXitIAJz
- TLSH
  T1C7244B4A97D1DE7BC91182328CA70718BB35E4911B439FCB2F0811797F637D8AE76A09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Engine/$R1/32/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 d9c4fd69f7bc0bf1f9066df0502a57de5f6d73dfff99c9fe5c75b491aecee86b
- MD5 81dfefdd5a24792d13f3096601a9b4a0
- SHA1 c994d24f553bc0c2376f0ef2142817699bc69272
- SHA512 6cd665b52d32eb1438bf48b5bb75c5ca8a6004b61633cfb7c888a42875c222041f5360501acc33962b059ba44e85f0e4807370b63554ce15f6191930d66c1c17
- SSDEEP 49152:0bQhj1xxRKpH9srFVSvI38QvLQ3ZdtrgDQtpYyB:00hj1olcFVCY8QS
- TLSH
  T1CAA53931E61ECA35DA8C1070AC39BB5F026DBA6E0B2555C7B3A41E3D6E325C27B34947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Engine/$R1/32/symsrv_windhawk.dll
- Size 320KB
- SHA256 7a9fadded044916c645789a1e7185b0bc83f226052dc93015d59826541dcfa4a
- MD5 7c424c4ca79cf880a0ee31888036dd58
- SHA1 2e6debed8fa94c91dd483311fbcb09d70b2d9df3
- SHA512 ae06e52a7bb0111b1d566079cb907b2437e9f99ca07b3dffae76e149f41ca375cb0e5eca6f4bdf939e98d9506c93817b98f365842691567ac038545aa5d74c58
- SSDEEP 6144:Iyd17qp3JfUkAa/Bvk3j7DndpaXPSUh/4+LRA:Iy37W3dhGXdEKUhAIRA
- TLSH
  T1A9643A2366D89175F9FB36B47AFCA669867D79A04B72C1CF1240968F0865AC09F30373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Engine/$R1/32/windhawk.dll
- Size 905KB
- SHA256 67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f
- MD5 f7bb000645c99f89ff38c6f7616c205f
- SHA1 4f76a9b030ecb1b9b9861e5be2787f63e78c0723
- SHA512 33623281a35d29ee18d59fc9d286b9c83903d781b5634d4d9fc7918cc5b74027cb2d9f6fd8ecf35391c201549068d1898cada742c6947c00bfc9cbb91c1ee6e7
- SSDEEP 12288:vPtFKXRL67yB1dEQ3d6GHBKLP+M+sWe1NUtcpNd+5w6uZNZcLpixp:3tRI1dvBOWM+sWeDww6uXZcLpixp
- TLSH
  T132153A72EE41B433ED3419345DA6076B663E91A0976281C7278C293E5DD1BD02F32FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Engine/$R1/64/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 6465aca7b9a162726ca98c6e633fc70b8cb2a8c0a4f90c2b32e0ca99fb5f9cf8
- MD5 8851e33bd5380f05720d25139d6f84cd
- SHA1 481577bdebd28ed0d6db90f181dbb09998f26c89
- SHA512 98e785d61ea14be511f27d9c865780f237ab0f5276f8a0feb921ac102c81ab6076e4a03ca088f2609c3cdedba040140ce258359c8479c2cd3d877c7bcafbed16
- SSDEEP 24576:i4xB9eY1DnidGfmPPUmSyankyA7IJ7cPBNWOWtY/YmBpoMXyOkr0ZZ+1E:+kZmHZSywAIJUBNYtYAmL6Okr04E
- TLSH
  T10DA57C67F3A841ACD1BAC07CC56B9606EBB278460320A7DF12A0567E7F13BE159BD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral9
- Target
  Engine/$R1/64/symsrv_windhawk.dll
- Size 422KB
- SHA256 67bdff85d161888f2c6a8a385f9b35aa1c1c231ed3b59c01fa54f598ac37d374
- MD5 2148e12ba31e49c815b83d52af8d2a61
- SHA1 abb520caf7133df5f61b787367d84859de375d31
- SHA512 26aec2331fc040ec13f6e81555a05d1d9f41e5e74ce23375a1d4f0a4aa1cb4e3a5d82259ba4f2e8ffafcfe3252cef7b60b5aee4a2745d0a04d7ccd8765876f33
- SSDEEP 6144:0Y7jrEtTBlB+HqbtYnwbnt7aSjAGqx0lcdEzlDy21qar2bXQY:0YgJ64Yct7a+AG8zi1yUqc2T
- TLSH
  T13A94192DE7E80465F1B2B5388AB78605D7B278A91775D2CF1194C13E0E27FE4AA34B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Engine/$R1/64/windhawk.dll
- Size 956KB
- SHA256 0aad074caf156200be7a77e4615f9171cea884cde96baf90397366c28c4f10a1
- MD5 5e377e811ac2772eb6ecaaf04063ac3d
- SHA1 6d1f24c87be48ef93ffd6773957f73eda7652192
- SHA512 3b5686eb8501015edf228d9552f55c89450934f69f2553069018188b5483b1f9ced43010a9a105cdc29dbf012f300a6652e60662f4c1a76b198b8ceb019d5af2
- SSDEEP 12288:LuItYj/l9fjIoAQ2BAM7UtcpNj+5goVuQxrDY:L8j/zUoArAKu7Vu+4
- TLSH
  T105253BB3EF502476E831953489B30727A27BB4909761C6CB2748252E1ED2BE02F36F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Engine/$R1/arm64/msdia140_windhawk.dll
- Size 4.8MB
- SHA256 385ce9aae0dc0cdcbfa21e86abca5a9ea4a7fbf891d43b51852fa7d023a629cf
- MD5 134053ab9dc9f855bc0bad52a05e3abc
- SHA1 4bd552ab8f7f21c370aec808363b358c9140d71c
- SHA512 9ffc60ab29e8e6fdddbd58e775b9efad4c8fb438a4f63b92ffae2004b7814d7abefb107eb79998f3f549f1743ee2da131fa3e6e8a64546710b07edbdbc7ed1ab
- SSDEEP 98304:EzqS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0KB7cFLDiXEpYk23pnaV2sd2xF6tjRxy:RS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0e
- TLSH
  T1AF365C11AE8CA835D2DAD33CEFA34F60213BF574C0688D87F25A035CED96FC19596296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Engine/$R1/arm64/symsrv_windhawk.dll
- Size 708KB
- SHA256 97610e918b8f33fa5ce3b337512534d817057f1bcbed257241aca0c7f30c65ea
- MD5 0f965e8d97122f7ecbc01dca6ee16a61
- SHA1 4a9c724c922b57220858004861511b67b7bfeda9
- SHA512 1bc1fc5a6615e82f4709a4662b136a57ab211cf123dc796d7eb07d67e869cee62f2a2e82a125336d54d81fbf902f212fa448ef33985ceabddd563690ced79af4
- SSDEEP 12288:fyJ+9eO2zqg7XRueQEYpOfUQuj6VhHaYk+nyo3M9NdaknHX:xLjYkzo3Mdakn3
- TLSH
  T167F42A826ECC9845D2D6F73EDC678A24633BB8BD4438D24B6142220FDE9D7C4D9A1763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Engine/$R1/arm64/windhawk.dll
- Size 1.7MB
- SHA256 60c72a84289f333704c8e35d21e7b1362d0481c426041daac0e5eb7af7d13c1c
- MD5 6b285136c41ed5d042ac4d7c153e933a
- SHA1 fefe4bcd935eb2f33502c9d96ed5366b6c575e4c
- SHA512 477ed9ff44d10284d83c7616966397e57f3bed4356ac0a29f62ebc8cd6f76a3b410e832eb6e9b531f59ee61d552eb642aab878170357d7809f90c0f31c2fb663
- SSDEEP 12288:CeQuh4pjNWiwruly0WkVYuLYIL1IBR7KzlWStymDyUEdOZvvATM30ZwRrlDuhsy:rubWiwrul/YJVmDyUEdO1vjrJgsy
- TLSH
  T1C285C5F85F0844EBE1E5E73CBE614D39603D2C76D6A919C600229F07D85AE9872E1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  UI/resources/app/extensions/clangd/out/bundle.js
- Size 797KB
- SHA256 4537d7e62ce3fd248775b44a8df926d183417767d83510f3ec96193d2bdc8400
- MD5 2a1e30271097955b02d3d2e68f0a16b0
- SHA1 5620916ca1cfb36e23bbd9ffa91f7fae0a13993f
- SHA512 0398c9be10070deedec92572241b7687293c865262970734bc0b8e17d63100e727ec28231afab89a2a5bc4de7c4012d1fc13c9c68ce6ed5f610290ebba78fd9e
- SSDEEP 6144:rZGO52dyh05f+g5jw1oMoZdjduXI5WzzRCy0tCL5qSyUQ5/usqY03XEI4elgPyef:dGO5sgWVTIUTnBhLOo7P6K
- TLSH
  T18C05E6D5F2A122AE229E938CDCA6006EA5B710F8600DB434F5C4ECDD149DECD5267A7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  UI/resources/app/extensions/windhawk/assets/main-icon.svg
- Size 2KB
- SHA256 084a27f3ced9a7527d7fc453e0d94f3e3d668b14f30aff6b3ad0af8a5ff69509
- MD5 e644197c4f128b379c68a3f5b573568c
- SHA1 1f70edd30ef7fe22ca0c872c3f359a9d03c85d62
- SHA512 aab9e4b5b1415773bfdc647113fabfd5edeadd7342c7d2f9aca610474d83290a2bf7f0a59984ad80918dc7cec38a6651f77bb8f4b8c73ea744640172317d3962
- TLSH
  T1D841B828830803F4F21E170CC5C578FA32D878DBB248F69890193DA5E5EAD580C2B0DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral16
- Target
  UI/resources/app/extensions/windhawk/assets/tab-icon-black.svg
- Size 1KB
- SHA256 40424e2915a4790058b86b8c855748b73e977ab2a9b18ca0359819eb55f6d18f
- MD5 a8100c7b4c31ae9d93696a9794e3cd9e
- SHA1 384c6c3946897ced5ff759b9bb03a333b5969681
- SHA512 80f20509ecf5f513ada305ec158ebc9084a67c1f1c02e5dec045df150897a762ef5f6a8fb6e7ed66941d74b895176b52dd843f640c8ae1c2bf3aaec27a0d1f94
- TLSH
  T1C521B12AC2600B74AA4E123C55F449F139C8EDDCE198FABD689B5011F02C6A5A461BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral17
- Target
  UI/resources/app/extensions/windhawk/assets/tab-icon-white.svg
- Size 1KB
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH
  T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral18
- Target
  UI/resources/app/extensions/windhawk/dist/33ff5c221241d3c55cad12b54045a5a1.node
- Size 533KB
- SHA256 d52b26d696a7005156e47e1bcbe8f6c4687be2c390d2f7bb6dbbf3278af09315
- MD5 f1972fe0822e77e1cd15bbbb7781f1a4
- SHA1 a3a90c0e4a54882c4dd8299b6315377f2a1d76f4
- SHA512 5e8fa131da80eb97155c388f0408b3b09487c6895a3f55c2012a606eb2d10de6b6c0861f54c48052290f399ae64adefdba94680850cb4ba7357b3fe948b55445
- SSDEEP 12288:wZuRZGuTuiQVEemR+cg2FN9v8OCIBySiWNE:1klWNhv0FWW
- TLSH
  T19EC47C5174918272DCF920F946FDBA3A426EE4B00B24A5C756CC47FEDA209C0AF3765B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  UI/resources/app/extensions/windhawk/dist/extension.js
- Size 467KB
- SHA256 46a52a698db47d04cb134c7dca57a42a294bed614bb1c8323862219532c29563
- MD5 9c6e57bfc7b39fc68224bcd201112c48
- SHA1 dd8e49a6871a825b57a8497d9171700cd551ebc7
- SHA512 626297d2d95723066e86a95d0126c0ffe765c4179b4146afa7d6ff0bb46ca9c673687c0d6b1df43900c9a0d6a813abe74c7fc9930d5f256d67125d306c7917b8
- SSDEEP 12288:LBDupgqVjYlBUrR2YYC91AsKMfZgd1gBGHZpNn2zUQKnolbQ8dc:LtupgqVjYlBUrR2YYC91AsKMfZgd1gBi
- TLSH
  T12BA430A6F6A0139E366D439CDD9200BDA8B711B8604DF834E8C1EDDD109DBCE5257A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  UI/resources/app/extensions/windhawk/files/DbgViewMini.exe
- Size 138KB
- SHA256 8703b7aed15d389324de080a24a4a5672c33e952f0a3461c3608e68e05a0a939
- MD5 f94bc325b06db0e50fd6c4612058a175
- SHA1 19b5628abd23d95c6c0ddfe9838898d052960e1c
- SHA512 4f33f42c49ffdb7a336ac905c76e73dc41b17ce890d731ec0a4e8e810df14968e54e38068cd26b7324173689f9d27f456678b8caf76dfc1bdba1c349f936384e
- SSDEEP 3072:m/p1LbOdij70TvwlOOqhyuw/NqUYvzFbQYTknlwaNfzgbD:m/HPlfqhvw/NJuZQTrgX
- TLSH
  T19CD38D11B1C0C472D87329310974DBB29A3DFD710F50AEDB73981ABA5F243D19A2A97B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-ia32/node.napi.node
- Size 112KB
- SHA256 b979a6bc99053be765ee53d58fc0ef7e944104e5818a0a74bb3f7cfa7b9d803a
- MD5 de11d7e148d07627b1fba4a56bd83107
- SHA1 24d29bf1f04f44324d8a01dfc5ab729b3f6b4756
- SHA512 2233b0d54cb98d4bc430cdd4f0f8a236c62dcfa10b240eabb00dbd54389b9ed1c851d337065b09586140eca5de111e928183f8f80557fae1d6a3a5831f10c739
- SSDEEP 3072:kI5/emAXbQhD+8LqGXdsV3Gyig8HTehXtwX0SFWYc3Bv:N/ens/qGNsXgW3Bv
- TLSH
  T132B35C11B681C131D46F063918309A769B3F6920DFB18EDB77941ABD9E306C1CE3DA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-x64/node.napi.node
- Size 155KB
- SHA256 4e101edf72e969fcec40007f68c40fb2b84bddf038b178b5e52e8d81f15c23f9
- MD5 c89769d232ee68872ac575995294bf24
- SHA1 30e86120ad51815439f0db3dd7d06435eeb2bfec
- SHA512 0c6480edcb6e4b84ae5aec3fa76ebfb31ac8b52bd20914f6422ec6cd12d7ff729535a86e9d84225ea7aae0fad64ccb5814f96585da62ab6e0807c79354c59d3d
- SSDEEP 3072:OXW2nM6Mci8/pc4e+BekFjNyPVXAh7O9QXkdd8HRROqqw:OXPMTciIpbZeQjoHKHRRv
- TLSH
  T1B0F34B0BB2B511BBE176C23985D39A11E77274150720AB9F43A0437A1F637E1ED3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  UI/resources/app/extensions/windhawk/webview/288.096949bbd6c72012.js
- Size 9KB
- SHA256 83e1cc8913ced19c57b57a283efb9093c20aa53347392be256d16edb81f8ac1b
- MD5 ae916ae853ad7e756671b101b33cf1b9
- SHA1 edd9a32d66d32c124c1488a008f1682c81ceacb0
- SHA512 3e7b0b4b5c9a1718c6c412ba1301227de7b103dd6e3177a2a3746d0efc8f547740247a72b95147647d55cc69ced31e1215c1a9846315ecac97c8da8fa527d809
- SSDEEP 192:NuhLiW5DT68tCzLbfIXEeorG0MPhhW82A7/vcwYa1S9brv1nayMeV:ANiGhUbV9G0QhsRA7/v1YAS1rNzv
- TLSH
  T12A1285A4F7E074620393A0A0D17F1D0B73763965548A81BCB264D8EA58FD18DD62BFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  UI/resources/app/extensions/windhawk/webview/873.3a09456777c6073d.js
- Size 4KB
- SHA256 d1ea123f06b61bfadd88af34eed222181f0ff11f48dea67428b64833fdfb423c
- MD5 385c173ad88e246d777dfef6bdb0a41b
- SHA1 9a5b829e7e72a76bdd735e5c852086efecad8872
- SHA512 895be1e5f629087389d6d8e9d334026c818dc50639b0992a386097f2815889df90f7d4a2598eebb2cc52a54b6af6f1370f8709ad9f2892832cacb7a706b0ec93
- SSDEEP 96:k8hjlpch5mV1+/0V1+/OvrBU+A/B1390elEZVOQaB9+aB9wd8rCD53m:kOj3crixBvrOP/BEIIVOJJmqom
- TLSH
  T10291751DD84A260E259E175815F19FE43C893A34D1B9DEC4A6E0C1D4E3B68CC60EBB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  UI/resources/app/extensions/windhawk/webview/editor.worker.js
- Size 284KB
- SHA256 7f1ae47bb78af26a5f43f2e138ba4cc8392286a241b32df03f2b42b849ac2a2d
- MD5 ac9223cbc3245ceca0aab79c40e0da87
- SHA1 52fcecf60ef9b104ea0ee185ba69895cc3eb4aa1
- SHA512 ea1e26699cdadbeaedada683cf152bcaee326f1a578818bf4812e77b8dc1caa9ccfb13e72afae6a1b9130e082eb361acff7a81d0b01794d1a07d40b1b37db185
- SSDEEP 3072:Y8FMjeojSPNqtnh8159PIUi8njZakUYO3dfy3Xhy:EjSunh815dICdWZy3Xhy
- TLSH
  T176541BD13292966BB3E716E760710103A53825A6BC0D147CF3B4DADF793B98361BAB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  UI/resources/app/extensions/windhawk/webview/index.html
- Size 799B
- SHA256 c0020888674a2b7beb2f4079b31b27206492f49a69456fc6ee98893646a7cdea
- MD5 26eff42f15b855c74f361bb5459c645b
- SHA1 b10eec709c07b108e3191ab2ed5c61f8b0342ade
- SHA512 776841c0e8fa4d8cd50b6fa5fc38e1aff685c93d97b5d25466efb2e0d16bcfc0400ea2f9a4064178830a0124766ed64f0801a3e75dfe96320d79efa195b1fa1d
- TLSH
  T1270120528C64C85913841B652EA5BD080D4ADBCBEB09EC543CCE015F8AD4FC9CED779C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27
- Target
  UI/resources/app/extensions/windhawk/webview/local-mod-icon.70a258753b360ed1b8d4867fd77337e2.svg
- Size 1KB
- SHA256 e4f7fc71fcdbd8c31f8580110c84ea951870dc20e2e3e3fba9b91203bafe29fe
- MD5 0d29caa52c3150978bccb41a079b4240
- SHA1 a90180d61ac60ef6c538e2231b92add9195a6046
- SHA512 1a61bb7a3eae9feb28db2cf7952c13626bd48b5d977240da5a38eaf4a3a0d0d1976456d027e5885f941e7abd1fcf2ee172aaedff08cf6458e6c5edfd628362e3
- TLSH
  T171218A6C76FC9978085FD7B96F6401B0AE0EA59F84286A78F40DCD31F7128B99932C17
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral28
- Target
  UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
- Size 1KB
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH
  T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29
- Target
  UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
- Size 5.4MB
- SHA256 a772f98f408cc230e29d6dbebfadffac92310fe4d7220752262c09d6776dba2d
- MD5 a394cbda564c74d5404b7175d915efa4
- SHA1 7f7eb44f90767875a35884d8313e00328ae50ecd
- SHA512 5cae4ab95059926311df1ea40973a722b2069d3e040f3d1698d9c5eac2bc7e0cc9322189ecc4762b2287ae2afeb2db29ae5a225cc7c876dce49514e985931c2b
- SSDEEP 49152:JkwOSFftdAnCpIPOlFj7wMawIPvfUhrqstlsN4n1wauYPkQEQrEf2C9PrSjaFX3/:Snfdazz8uC
- TLSH
  T1FB4639963245706643DB51E660BB0103B3392459B809846CF77CECDE29AFE8672B7F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
- Size 169KB
- SHA256 cff2446e6c40f4151ba3b7a568c0a361a5da31423f242085cb10fe938e5a4281
- MD5 e37fa198f2ba94998952d5773556a6cf
- SHA1 af8b924c85d3925a6d5b917629efc877140f275b
- SHA512 ac83d6586470324b407440248ce8fafbc990f215a01cc6ae6c103c1249d438d1c3aadbf710cdeb8d7d376b85641a2d2d345fdd216f851c12ae39afc055da2da5
- SSDEEP 1536:EX9EL2TLM+H1+TNReVZ4KYJTmqS/n6DrU4aRus+LynbQgStd93ZoJin:EtEq8UUNReYKYJT+6vNkkLynbQgSD9p7
- TLSH
  T1E304E784F291B0E202A76414606F4447F27B1B46A80D99A0F707F9E1787FD4AB1B7EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
- Size 3KB
- SHA256 856bec59e1cea6b7e36d128de2e393eec8548aa8d75b5a389a72195373865bb7
- MD5 a5bb6d4a3db136fd6200785c7dcca349
- SHA1 9519a03d7eca7a3443d3b312cd4e9edc284d0eaf
- SHA512 dcce525424dc27206633c877dfa32469343f38ae54f2f13703bfc80cb56bc2c5e4818e1ea92b57507e2ec9906299e9f62f6037a7929776740f34775824d3340d
- TLSH
  T14961B6A62664F4B727A158D1042FC592F716243705AFF8F0A717DCB5B878CC54862FB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32