General

  • Target
    c94b268402bb0f53c7caa019594f20f0962085d0fa8a82e7553d9d7af4d6b734.zip
  • Size 9.7MB
  • Sample261007-1rsfascf72
  • SHA256 6df8d5017b9e2e88b8b1cf1944c2b163c4805625e5b7e764618812559ada286f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %LOCALAPPDATA%\AuthWebhook

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • DLL Hijacking vulnerability 13 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 4 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • c94b268402bb0f53c7caa019594f20f0962085d0fa8a82e7553d9d7af4d6b734.zip
    .zip 9.7MB
  • BCGCBPRO1100u100.dll
    .dll 4.7MB
  • CircuiTranspon.exe
    .exe 108KB
  • CreateMiniDump.dll
    .dll 26KB
  • FeatureSwitch.dll
    .dll 62KB
  • PPUtilLib.dll
    .dll 300KB
  • XMaxUtil.dll
    .dll 79KB
  • cvmaxpdf.exe.config
    .xml 241B
  • maxcodec.dll
    .dll 110KB
  • maxkernl.dll
    .dll 166KB
  • maxrast.dll
    .dll 157KB
  • mfc100enu.dll
    .dll 54KB
  • mfc100u.dll
    .dll 4.2MB
  • msvcp100.dll
    .dll 412KB
  • msvcp_win.dll
    .dll 480KB
  • msvcr100.dll
    .dll 756KB
  • registry-sync.yaml
    28KB
  • sandbox-patch.dump
    4.4MB
  • ucrtbase.dll
    .dll 1.1MB

c94b268402bb0f53c7caa019594f20f0962085d0fa8a82e7553d9d7af4d6b734.zip

  • SHA256 6df8d5017b9e2e88b8b1cf1944c2b163c4805625e5b7e764618812559ada286f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected