General

  • Target
    恶意软件分析.rar
  • Size 8.3MB
  • Sample261010-exynlsfe86
  • SHA256 824646c1afdf0a39edd60c2d3128ce984dd8f6bb3ed88c9a2d3212f9418316e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %LOCALAPPDATA%\AuthWebhook

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • DLL Hijacking vulnerability 11 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 4 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 恶意软件分析.rar
    .rar 8.3MB
  • AuthWebhook.rar
    .rar 8.2MB
  • AuthWebhook/BCGCBPRO1100u100.dll
    .dll 4.7MB
  • AuthWebhook/CircuiTranspon.exe
    .exe 108KB
  • AuthWebhook/CreateMiniDump.dll
    .dll 26KB
  • AuthWebhook/FeatureSwitch.dll
    .dll 62KB
  • AuthWebhook/PPUtilLib.dll
    .dll 300KB
  • AuthWebhook/XMaxUtil.dll
    .dll 79KB
  • AuthWebhook/cvmaxpdf.exe.config
    .xml 241B
  • AuthWebhook/maxcodec.dll
    .dll 110KB
  • AuthWebhook/maxrast.dll
    .dll 157KB
  • AuthWebhook/mfc100enu.dll
    .dll 54KB
  • AuthWebhook/mfc100u.dll
    .dll 4.2MB
  • AuthWebhook/msvcp100.dll
    .dll 412KB
  • AuthWebhook/msvcp_win.dll
    .dll 480KB
  • AuthWebhook/msvcr100.dll
    .dll 756KB
  • AuthWebhook/registry-sync.yaml
    28KB
  • AuthWebhook/sandbox-patch.dump
    4.4MB
  • AuthWebhook/ucrtbase.dll
    .dll 1.1MB

恶意软件分析.rar

  • SHA256 824646c1afdf0a39edd60c2d3128ce984dd8f6bb3ed88c9a2d3212f9418316e5
  • MD5 SHA1 SHA512 SSDEEP TLSH