hookloader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hookloader.exe
Size 19KB
Sample260925-tpde2azhrg
SHA256 47e24c479ceef89c417e432d8cdc7e31e9784092b8038853e6439b326d91b54c
MD5 e106cd93091a83dca02279f760c085ed
SHA1 b49e04283126b2b33cea79017621860ee726be2c
SHA512 d9339a77bf0cdf402b2645e9a82e555f3569efc3942fda59ba0dddcdd95a77773f5ff2b675e32e4d88e41639642580cb675d41262fc8df4309efb0a2308af664
SSDEEP 192:eQWFruw+b3MaHHTqTXAz81I/q9mjSQuaqrnn5rN15rg1+5zlnffwVSy6/YW5tfr0:7W4v3LHHTqDAZ/jWpnn9N1ta+oGFVmp
TLSH
T1D0924C4BBB9684FAE0B9C139C9939619D272B40A572267CF23E1425A0F667C07D33F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hookloader.exe

File Explorer

hookloader.exe

.exe 19KB

hookloader.exe

IMPHASH ef15a53374c062b187555bc9fb3b3db2
SHA256 47e24c479ceef89c417e432d8cdc7e31e9784092b8038853e6439b326d91b54c
MD5 e106cd93091a83dca02279f760c085ed
SHA1 b49e04283126b2b33cea79017621860ee726be2c
SHA512 d9339a77bf0cdf402b2645e9a82e555f3569efc3942fda59ba0dddcdd95a77773f5ff2b675e32e4d88e41639642580cb675d41262fc8df4309efb0a2308af664
SSDEEP 192:eQWFruw+b3MaHHTqTXAz81I/q9mjSQuaqrnn5rN15rg1+5zlnffwVSy6/YW5tfr0:7W4v3LHHTqDAZ/jWpnn9N1ta+oGFVmp
TLSH
T1D0924C4BBB9684FAE0B9C139C9939619D272B40A572267CF23E1425A0F667C07D33F85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

aze

Minor OS version

Major OS version

Entry point

8472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Downloads\SetWindowsHookEx-Injector-master\x64\release\bin\hookloader.pdb

kernel32

GetFileAttributesW CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetProcAddress LoadLibraryExW Sleep GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW

user32

SetWindowsHookExW UnhookWindowsHookEx GetTopWindow GetWindow GetWindowThreadProcessId PostThreadMessageW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ _Query_perf_frequency ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context __std_exception_copy __std_exception_destroy memset

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function terminate _initialize_onexit_table _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _crt_atexit _set_app_type _register_thread_local_exe_atexit_callback system _invoke_watson _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale