c94b268402bb0f53c7caa019594f20f0962085d0fa8a82e7553d9d7af4d6b734.zip
- SHA256 6df8d5017b9e2e88b8b1cf1944c2b163c4805625e5b7e764618812559ada286f
Behavioral task
behavioral1
Sample
CircuiTranspon.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
CircuiTranspon.exe
Resource
win11ltsc2024-20260911-en
hijackloader
%LOCALAPPDATA%\AuthWebhook
%windir%\SysWOW64\input.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/sandbox-patch.dump | family_hijackloader |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/maxkernl.dll |
| unpack001/mfc100u.dll |
| unpack001/msvcr100.dll |
| unpack001/msvcr100.dll |
| unpack001/maxkernl.dll |
| unpack001/msvcr100.dll |
| unpack001/mfc100u.dll |
| unpack001/msvcr100.dll |
| unpack001/msvcp100.dll |
| unpack001/msvcr100.dll |
| unpack001/mfc100u.dll |
| unpack001/msvcr100.dll |
| unpack001/mfc100u.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/BCGCBPRO1100u100.dll |
| unpack001/maxkernl.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/mfc100enu.dll |
| unpack001/mfc100u.dll |
| unpack001/msvcp100.dll |
| unpack001/msvcr100.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=5, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1639, id=1, productName=Unmarked objects,
count=272, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=19, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=350, id=1, productName=Unmarked objects,
count=17, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=9, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=55, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=5, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=670, id=1, productName=Unmarked objects,
count=47, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=146, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=152, version=20115,
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=84, id=1, productName=Unmarked objects,
count=31, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=173, id=1, productName=Unmarked objects,
count=38, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=164, id=1, productName=Unmarked objects,
count=26, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=152, version=20115,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1005, id=1, productName=Unmarked objects,
count=412, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=155, id=1, productName=Unmarked objects,
count=1, id=152, version=20115,
count=8, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=48, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Mar 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1213, id=1, productName=Unmarked objects,
count=8, id=259, version=30795,
count=28, id=261, version=30795,
count=1, id=256, version=30795,
count=133, id=270, version=30795,
count=1, id=253, version=30795,
count=11, id=260, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Detects HijackLoader (aka IDAT Loader)
May 9, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=30795,
count=22, id=260, version=30795,
count=1, id=256, version=30795,
count=108, id=259, version=30795,
count=94, id=261, version=30795,
count=621, id=270, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,