hookloader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hookloader.exe
Size 37KB
Sample260820-cxejmaba64
SHA256 4c3abddc364089a47bec771495c1b43a32f255610f93b930b868846c1a48a96b
MD5 c2e0d6592370e8b381feddf04705c46d
SHA1 a28051887359576502e5f63cad098d346a4fc048
SHA512 7b4704b947ee5a9f4651f8da83e266158ba8787c3c94ab1fbbcd88dd3b1bb504c290a2b237247ccd4a28638b195176e99b59a9da3f06479218b75d4fe2b6cc34
SSDEEP 768:9YM2eWKedDe6cmo759lUFbp8T6E/njKrTnhsGXXriQKTyNZXfTt3uxgCP:9oKe0b/7dqYKniyNZ7ugC
TLSH
T1C4033B1B6B6904EDE1A7D3B9C6930A05C7B2BC5607A2E7CF1781D25E0F672C1687EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hookloader.exe

File Explorer

hookloader.exe

.exe 37KB

hookloader.exe

IMPHASH ef5e9b821773a1d2b3b63e9fa9ebd7ca
SHA256 4c3abddc364089a47bec771495c1b43a32f255610f93b930b868846c1a48a96b
MD5 c2e0d6592370e8b381feddf04705c46d
SHA1 a28051887359576502e5f63cad098d346a4fc048
SHA512 7b4704b947ee5a9f4651f8da83e266158ba8787c3c94ab1fbbcd88dd3b1bb504c290a2b237247ccd4a28638b195176e99b59a9da3f06479218b75d4fe2b6cc34
SSDEEP 768:9YM2eWKedDe6cmo759lUFbp8T6E/njKrTnhsGXXriQKTyNZXfTt3uxgCP:9oKe0b/7dqYKniyNZ7ugC
TLSH
T1C4033B1B6B6904EDE1A7D3B9C6930A05C7B2BC5607A2E7CF1781D25E0F672C1687EE40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\hook\hookloader\output\hookloader.pdb

dbghelp

ImageDirectoryEntryToData

kernel32

LocalFree FormatMessageA SetConsoleTextAttribute SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetConsoleWindowInfo GetConsoleScreenBufferInfoEx GetModuleHandleA GetConsoleMode SetConsoleScreenBufferInfoEx LoadLibraryA GetProcAddress SetConsoleCP FreeLibrary GetConsoleWindow SetConsoleOutputCP SetConsoleTitleW LoadLibraryExW GetLocaleInfoEx FindClose FindFirstFileW GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter CloseHandle AreFileApisANSI CreateFile2 GetLastError GetFileAttributesExW

user32

GetWindowLongPtrW SendMessageW SetWindowLongPtrW SetWindowPos ShowScrollBar GetWindowThreadProcessId FindWindowW

msvcp140

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset __std_exception_destroy memcpy

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argc system _register_onexit_function exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe terminate _exit _initialize_onexit_table abort __p___argv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

strlen