hijackloader | 824646c1afdf0a39edd60c2d3128ce984dd8f6bb3ed88c9a2d3212f9418316e5 | Triage™

Login
Reports

Overview

overview

Static

static

AuthWebhoo...00.dll

windows10-2004-x64

3

AuthWebhoo...00.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...on.exe

windows10-2004-x64

3

AuthWebhoo...on.exe

windows11-ltsc_2024-x64

3

AuthWebhoo...mp.dll

windows10-2004-x64

3

AuthWebhoo...mp.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...ch.dll

windows10-2004-x64

3

AuthWebhoo...ch.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...ib.dll

windows10-2004-x64

3

AuthWebhoo...ib.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...il.dll

windows10-2004-x64

3

AuthWebhoo...il.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...ec.dll

windows10-2004-x64

3

AuthWebhoo...ec.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...st.dll

windows10-2004-x64

3

AuthWebhoo...st.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...nu.dll

windows10-2004-x64

1

AuthWebhoo...nu.dll

windows11-ltsc_2024-x64

1

AuthWebhoo...0u.dll

windows10-2004-x64

3

AuthWebhoo...0u.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...00.dll

windows10-2004-x64

3

AuthWebhoo...00.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...in.dll

windows10-2004-x64

3

AuthWebhoo...00.dll

windows10-2004-x64

3

AuthWebhoo...00.dll

windows11-ltsc_2024-x64

3

AuthWebhoo...se.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
恶意软件分析.rar
Size 8.3MB
Sample261010-exynlsfe86
SHA256 824646c1afdf0a39edd60c2d3128ce984dd8f6bb3ed88c9a2d3212f9418316e5
MD5 eca3d82e4ac9ef8093eb7f05c9657c5e
SHA1 1ed53c3db6e38c7c3874366a6219308bb590dc1a
SHA512 545a26da0a9a4a601832cf1477f182739692d409230bb4f99c9e45629252d85a7adb986ad1a69a682adba2579fb787a0deb7753d8433964489f5d300feb0abce
SSDEEP 196608:UhBGzNaWaeRCxDLT4Y4qgvRElrREWsAjQzDz:SgNBbRkHRYzWRjYDz
TLSH
T1B29633E09E869491E82C388C5C932A52F43C5357F85A7904CFF78A5CE75D143A2EBBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hijackloader discovery loader

Static task

static1

5 signatures

loader hijackloader

Behavioral task

behavioral1

Sample

AuthWebhook/BCGCBPRO1100u100.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

AuthWebhook/BCGCBPRO1100u100.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

AuthWebhook/CircuiTranspon.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

AuthWebhook/CircuiTranspon.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

AuthWebhook/CreateMiniDump.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

AuthWebhook/CreateMiniDump.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

AuthWebhook/FeatureSwitch.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

AuthWebhook/FeatureSwitch.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

AuthWebhook/PPUtilLib.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

AuthWebhook/PPUtilLib.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

AuthWebhook/XMaxUtil.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

AuthWebhook/XMaxUtil.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

AuthWebhook/maxcodec.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

AuthWebhook/maxcodec.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

AuthWebhook/maxrast.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

AuthWebhook/maxrast.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

AuthWebhook/mfc100enu.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

AuthWebhook/mfc100enu.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

AuthWebhook/mfc100u.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

AuthWebhook/mfc100u.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

AuthWebhook/msvcp100.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

AuthWebhook/msvcp100.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

AuthWebhook/msvcp_win.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

AuthWebhook/msvcr100.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

AuthWebhook/msvcr100.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

AuthWebhook/ucrtbase.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%LOCALAPPDATA%\AuthWebhook
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  AuthWebhook/BCGCBPRO1100u100.dll
- Size 4.7MB
- SHA256 e650ae0d297b0de8b7a708003dc07e5a5ed7542b39e0519dcc11be582986117e
- MD5 b560e9da72827308c322f8c18c76617f
- SHA1 100e0c71d2890bc5ce600768e31c6c6b13f5695d
- SHA512 dccc1ad8ec97f559ef09f3bb245daa82defe558ec561c24512c08b0043851271cc54d09dc46216385f09afadfa287d86ff65061aa8ff0da0ef11adaca80e31fd
- SSDEEP 49152:inJn0WQqXU2JY33XK2dMYD3rzMwbzUVujdhHVUkdpRlHtgvDDyQkmMbJxY9XZ+x:inl0WOlK2Gw3fMwboVuH6kXRR
- TLSH
  T1C1367C30BE7C027AC5DE95B59E3E366F4D5EBD50472842C75168385AB870AC23633E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  AuthWebhook/CircuiTranspon.exe
- Size 108KB
- SHA256 5d501d3c51576a402a301470f7bf919b87e0f8a0ed40172dde3d7c1c622ccdc3
- MD5 a3d2a2cdfe0f51e0194de4e66f5a4e59
- SHA1 9e74abf1cb6ce8d4d8fd1a564fac9dfa3df806bc
- SHA512 5cdb2276cc69fff03ae7ee7566f46e3fc0603d0f7e0337f39f089ebdfa4563cfa6cdb8c83c3839c5767212578cc195f87d19a903ed50e26c7ca6643db5489005
- SSDEEP 1536:5x38QUYa1eDrFhKweJ13+V7XIw9mBiL5axtuA4Bd6JVoJGLn05UuiFCMR10NTkGr:PDijCUfjyMr17C0IEnOnDLCg/taX21
- TLSH
  T1DDB33A21B7449827E972D1776AF8FF294A2CE0B0479110DF72682DCDA9709D31D3A1EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  AuthWebhook/CreateMiniDump.dll
- Size 26KB
- SHA256 f6ddce7554a0d1b9786ee1822cc026fe97be5b4778ecaf349843fe79769907f6
- MD5 49405ba66b7a666c379a0e92812d05f5
- SHA1 7017394286c11c4cdab34ea3cf96fc7d79599149
- SHA512 bd3533d53ce77fb9219854992d1eb505859253726bdfbde8704272f4047022c5aa1ac1f6ffb439fdceb291f435a39936365f3c1085e451254b91f150f4d5f72e
- SSDEEP 384:P8IvV5BgO/P3f/VinPVPL08AIYikHKKKUe8JN77hh1ZyHIYikHK1e8JN77hhEX:P8A5BgEvYndQiYibUZ3h/ZyoYib3h6X
- TLSH
  T106C26CA60A5A4422EF9B4EF071E0E3761D7876D677D090EB6258C1560FC47822B683BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  AuthWebhook/FeatureSwitch.dll
- Size 62KB
- SHA256 9023552a39117772e5d44c52deef13b1066825f49b538c3849f6c7192091b711
- MD5 5ca0ba3dbf6e8adeb99f1ed97cc3123f
- SHA1 5af6a411b275c26365b7bc11f6922e5364aa8a28
- SHA512 5a64def2f357038a03cdfc8913dbaa06da9a2d947f18733df9dc6cd454b70f5eb1cabd4d6b342ae7bde2f00fddc9293135a48a99b913d18f271a9010b67d2d22
- SSDEEP 768:1yyiUPdWUUUWhvPNgpf4YYA/Q1K6h053antEDpm42jFy5vynA+QFAChYiAHfY3h/:0wvBuA/9mEk7ZtnA7ph7j3hCH7c3htz
- TLSH
  T113537D0565958033F3E35E382AF4E2B94D7F79422BF1508F2B6905B94FA17C19A3837A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  AuthWebhook/PPUtilLib.dll
- Size 300KB
- SHA256 178e832158c7fb2fffbeebb26b2a0ce35b710731b7cad51a600cfb7fe03a4fd6
- MD5 ccb172f4b6dac0374e203b9e90342e29
- SHA1 04473b0dcbe13bea53cbc90961fab9b206441f5f
- SHA512 dabe7b182ef06fc2d61886b568336fb03cce69431c045fc9f0ce0219d4967369d651f15e3c3c966fc538d89eba814d087eb817e5d95bbab44673cb3204586748
- SSDEEP 6144:wKg3kdXZ9g1Vg+kIWxpZ11OZhsl+KFJqzD:Ok/96kzpjFl+MK
- TLSH
  T15E647D207A568E37FAFA02349EBF661655ACB9100774C2C7E34C9E8EE8315C3993574B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  AuthWebhook/XMaxUtil.dll
- Size 79KB
- SHA256 5665023d6154010e09c38da961fee756abc5d0673dd62f9b9baa0fa70697f4bf
- MD5 0ec5fd79b9693951a807b6685c85ba01
- SHA1 48b843d2ab1fa7e7518ba4a402972539796dcec8
- SHA512 81d89b788de920da59a054e8440dedb2665356be46f6f3fe0dcaa4db98960870a8a47492c48ac40dfe14783bddeb8e08ebd2e179ba0c554ef41dd408add69a99
- SSDEEP 1536:KC7rwJtwGQj8CIw5Up5wo6nJp2Zh89MhCbV5OGpwwJfmMMwoT733hNr7M3h6A:KCJ4f6nD2ZaMIbV5OGpwwJfpSXrR
- TLSH
  T1A6835C527E198422E6F6057079BC6B6E383DB2622BE500CB53171A4D0DB0BD3BF78756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  AuthWebhook/maxcodec.dll
- Size 110KB
- SHA256 e4d065c0eb2e9d2212178a928365aeb1b7fcd4f9ee130fbfb9e5e797813c891e
- MD5 afc0e83ab3f9f1f045e7d0e55cbe2a0b
- SHA1 92f86b237bee8e83034904456ddace056d1b9d62
- SHA512 4e49852054b34fbf6afcf2a40fe769c580660911dcd98bf05cd7555880dd872591cee39f34169a0628641abe5d3380b5bc91d9bcd23ae1d97e456b7ef1f44edb
- SSDEEP 1536:DI1xxpkfYLtPZdjKL/VUPy3I8FPcoyIO8PjG35OS7xIy8qM7l3hZY7qL3hl:DIhp+YLtaLN4y3ioQ8Py35OS7xqNxYE
- TLSH
  T1EEB38D12F6818033E5F7067AA8FE9B7D0A3E70648F9610DB7B8467995D205D31B352CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  AuthWebhook/maxrast.dll
- Size 157KB
- SHA256 f39c0e4a85171484bade6171f4be8b2951e5de7c39f041160b9da2a44f4220c1
- MD5 056d60dbbe43ddcf7729937319b75578
- SHA1 643695ad727732d592af8dc4b9ddc10db18667f5
- SHA512 d2823f0c228c14444c27f2c3264b5fc80f0651d5cb5594e974be4942ec5665aafbad7f1bcf92359565a54e92638582c5b646c6477621b8637273a766bfa5f0ff
- SSDEEP 3072:0FJ2JIbY8XzQA4oASEl6N2Ld8Rj+N8IUpgtH55WEXmK+6jTdyAi8LuL:0FJ2JIbNzKff6UJudJsHn/2K+aTHuL
- TLSH
  T1F8F38DC2F9529E7ADADB087ED6AAAD3414EE0313077701E73665C941EB407C32DB528B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  AuthWebhook/mfc100enu.dll
- Size 54KB
- SHA256 ee7d56095c1ccaa93fb2e86ae9381f77cc60cb332dbdcca49da63896349f98b8
- MD5 3cf266ca615e03dc6c2afac0443d606b
- SHA1 92aed0a7811c9ed1eb1a5b87b296253b010ec962
- SHA512 838ef68081b91ca0c3dcc9e095fd472681c4bd23304b8b90a8d7858c06d848ffd8f41ddeab32e504741a8ebebdc1515d47eef5b31179fd95be3b5c69a60881c2
- SSDEEP 768:HgIdijcuEhCgy4Y6B1CLPLNq5f/nWHBNheOU2fd5c1viY+w:AI0ify4Y6B8PLNYf/nWHNTd61vj+w
- TLSH
  T1D143736263F98605F5F77F752EB546605E3ABCA2ED38CA0E1640614E0972F50DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  AuthWebhook/mfc100u.dll
- Size 4.2MB
- SHA256 515f8c3683c36ffaf64d01693bb83eeb1f0dbfddecf95ec4d7c3f08e7f00c0dc
- MD5 6358cc2a77f3c12c5b9b16190d5477f7
- SHA1 47ee1895c6e11248fa6cd2a594f6395335453d35
- SHA512 8eced5237cbd287b8a66044580b60fedf2a324ba377b2ac1e332f5bcd7aac6b212e9c4da1cd5f3b1aeafcc313da80040e634e05fccea60f803aaad19a18e6e7d
- SSDEEP 98304:ZhRRni1aewd5ZnDRB+5sCpffcU1jQV7jztl8bo1pKkXwLNVk7hERtCDJFLOAkGkh:Zhi1/2JIg9JFLOyomFHKnPAK
- TLSH
  T14D268D227ED990B4CDD321B0469E7679A26EECD4273406C351943BFBE9743C16E3898B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  AuthWebhook/msvcp100.dll
- Size 412KB
- SHA256 cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d
- MD5 ed40615aa67499e2d2da8389ba9b331a
- SHA1 09780d2c9d75878f7a9bb94599f3dc9386cf3789
- SHA512 47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee
- SSDEEP 12288:AOb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2ebe:AOb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ei
- TLSH
  T11D9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  AuthWebhook/msvcp_win.dll
- Size 480KB
- SHA256 4b218a354d58368cbbd884b58e6539ce38e54247eb6e0b5c67f202e9cec067a5
- MD5 66e604c9e8bb7fe0d02902c3c041e461
- SHA1 9dcb34d86fd45e75e34667183b0790676dce99be
- SHA512 c3027fd1b09c041b22750d302bc9f67cf88f82a082c3af792276ad34806b6b822286b9bebc51928a837cdeba3d00c06acd6cc3085c3c9cbd67a172df05bda923
- SSDEEP 12288:VDprVN3S7dLYu8AB5A5Pb4lGqLHK1BvSVJashUgiW6QR7t5s03Ooc8dHkC2esSaa:xpu7dLpA5j4nHKnKU03Ooc8dHkC2eraa
- TLSH
  T1C0A43C337A460AB1E48923B4328D536283F9EC654761A3C357DFF6A9BF152C06A336C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  AuthWebhook/msvcr100.dll
- Size 756KB
- SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
- MD5 ef3e115c225588a680acf365158b2f4a
- SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
- SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
- SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
- TLSH
  T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  AuthWebhook/ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

loaderhijackloader

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

© 2018-2026

Terms | Privacy