ProcessHider[.]exe

General

Target
ProcessHider.exe
Size 603KB
Sample260822-m5k2gstcpe
SHA256 e303fef1966e71160d092ce8d918e8bc85e3b448023db4583a437fb933cdfd6f
MD5 89cedf0a5b3833dc294ffc066350aebe
SHA1 cb1dcfb63470d19bffa9e7075b0167525182317e
SHA512 368e66be20ba1e063999313c59df49644c75cf90b45a34cc2d5f5ae7daf6e94057bf8501db040ff1f9d89323a1dce654909fed5d98e7d8fca44ac4691270aed9
SSDEEP 12288:kn8oaQp8wbTN2nr8XEpRwDNjkxItR1vNUJ:LoaQpfTmrlRukx61vK
TLSH
T155D47C07BBC094B3D97A493489235615EB39B8218B34CBDF13544375AF6B3D09E39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProcessHider.exe

File Explorer

ProcessHider.exe

.exe 603KB

ProcessHider.exe

IMPHASH c0e36dd50b174b7ca7a3fc896544ec9d
SHA256 e303fef1966e71160d092ce8d918e8bc85e3b448023db4583a437fb933cdfd6f
MD5 89cedf0a5b3833dc294ffc066350aebe
SHA1 cb1dcfb63470d19bffa9e7075b0167525182317e
SHA512 368e66be20ba1e063999313c59df49644c75cf90b45a34cc2d5f5ae7daf6e94057bf8501db040ff1f9d89323a1dce654909fed5d98e7d8fca44ac4691270aed9
SSDEEP 12288:kn8oaQp8wbTN2nr8XEpRwDNjkxItR1vNUJ:LoaQpfTmrlRukx61vK
TLSH
T155D47C07BBC094B3D97A493489235615EB39B8218B34CBDF13544375AF6B3D09E39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Matan\Documents\Small Projects\Complete Hider\MainFile\ProcessHider.pdb

kernel32

WriteProcessMemory GetCurrentProcess WriteFile K32GetModuleFileNameExW CreateFileW ReleaseMutex ResumeThread UnmapViewOfFile GetLastError LockResource CloseHandle LoadResource FindResourceW SizeofResource CreateMutexExW CreateProcessW CreateFileMappingW MapViewOfFile OpenMutexW IsWow64Process HeapFree WaitForSingleObject HeapAlloc GetProcessHeap CreateRemoteThread GetCurrentProcessId GetProcAddress LoadLibraryW VirtualAllocEx OpenProcess UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW QueryPerformanceFrequency ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetCommandLineA GetCommandLineW GetACP CompareStringW LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW HeapSize HeapReAlloc SetFilePointerEx WriteConsoleW DecodePointer

advapi32

AdjustTokenPrivileges OpenProcessToken GetTokenInformation LookupPrivilegeValueW

Resubmissions

Sharing