hashmanager.zip
- SHA256 e46594ff5a752f6271b9e19ec981c90cfc38a6a5b97b46dc07f147231c912eac
Overview
overview
10Static
static
10HashManager64.exe
windows10-2004-x64
10HashManager64.exe
windows11-ltsc_2024-x64
5Microsoft....ne.dll
windows10-2004-x64
3Microsoft....ne.dll
windows11-ltsc_2024-x64
3bResourceStrings.dll
windows10-2004-x64
3bResourceStrings.dll
windows11-ltsc_2024-x64
3msvcp_win.dll
windows10-2004-x64
3ucrtbase.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
HashManager64.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
HashManager64.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
bResourceStrings.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
bResourceStrings.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
msvcp_win.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
ucrtbase.dll
Resource
win10v2004-20260911-en
hijackloader
%APPDATA%\RivexAccelerator
%windir%\SysWOW64\pla.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/queue-prof.lock | family_hijackloader |
File was altered after it was signed.
| resource |
|---|
| unpack001/Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/bResourceStrings.bpl |
Mar 31, 2026
SERIALNUMBER=J12 /1244 /1999,CN=Softland SRL,O=Softland SRL,ST=Cluj,C=RO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302524f
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=J12 /1244 /1999,CN=Softland SRL,O=Softland SRL,ST=Cluj,C=RO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302524f
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Codesign digest Mismatch
File was altered after it was signed.
May 1, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=206, version=65501,
count=1, id=207, version=65501,
count=10, id=259, version=25711,
count=142, id=261, version=25711,
count=18, id=260, version=25711,
count=19, id=259, version=34321,
count=16, id=260, version=34321,
count=42, id=261, version=34321,
count=19, id=203, version=65501,
count=134, id=1, productName=Unmarked objects,
count=10, id=265, version=34440,
count=1, id=256, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
Unsigned PE
Checks for missing Authenticode signature.
Mar 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1213, id=1, productName=Unmarked objects,
count=8, id=259, version=30795,
count=28, id=261, version=30795,
count=1, id=256, version=30795,
count=133, id=270, version=30795,
count=1, id=253, version=30795,
count=11, id=260, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Detects HijackLoader (aka IDAT Loader)
May 9, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=30795,
count=22, id=260, version=30795,
count=1, id=256, version=30795,
count=108, id=259, version=30795,
count=94, id=261, version=30795,
count=621, id=270, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,