PLS2.zip
- SHA256 69b4237948ac88c62cbf829cb93024675a1619a23f3604f7ef76bbba2c98375e
Overview
overview
10Static
static
10ToolkitCo.exe
windows10-2004-x64
10ToolkitCo.exe
windows11-ltsc_2024-x64
5mssp7en.dll
windows10-2004-x64
3mssp7en.dll
windows11-ltsc_2024-x64
3msvcp_win.dll
windows10-2004-x64
3starburn.dll
windows10-2004-x64
3starburn.dll
windows11-ltsc_2024-x64
3ucrtbase.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
ToolkitCo.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ToolkitCo.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
mssp7en.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
mssp7en.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
msvcp_win.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
starburn.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
starburn.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral8
Sample
ucrtbase.dll
Resource
win10v2004-20260513-en
hijackloader
%APPDATA%\DidixResearch
%windir%\SysWOW64\rasapi32.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/bindinginfo08.cfg | family_hijackloader |
File was altered after it was signed.
| resource |
|---|
| unpack001/mssp7en.dll |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/starburn.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/starburn.dll |
Sep 14, 2024
CN=KirySoft S.R.L.,O=KirySoft S.R.L.,ST=Bihor,C=RO
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=KirySoft S.R.L.,O=KirySoft S.R.L.,ST=Bihor,C=RO
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Detects HijackLoader (aka IDAT Loader)
Codesign digest Mismatch
File was altered after it was signed.
Oct 1, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=188, version=30716,
count=117, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=19, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=141, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=184, version=30716,
count=58, id=189, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Mar 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1213, id=1, productName=Unmarked objects,
count=8, id=259, version=30795,
count=28, id=261, version=30795,
count=1, id=256, version=30795,
count=133, id=270, version=30795,
count=1, id=253, version=30795,
count=11, id=260, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=2, productName=Unmarked objects (old),
count=8, id=19, version=9049,
count=11, id=125, productName=VS2005 build 50727, version=50727,
count=175, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=23, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
May 9, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=30795,
count=22, id=260, version=30795,
count=1, id=256, version=30795,
count=108, id=259, version=30795,
count=94, id=261, version=30795,
count=621, id=270, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,