恶意软件分析.rar
- SHA256 824646c1afdf0a39edd60c2d3128ce984dd8f6bb3ed88c9a2d3212f9418316e5
Overview
overview
10Static
static
10AuthWebhoo...00.dll
windows10-2004-x64
3AuthWebhoo...00.dll
windows11-ltsc_2024-x64
3AuthWebhoo...on.exe
windows10-2004-x64
3AuthWebhoo...on.exe
windows11-ltsc_2024-x64
3AuthWebhoo...mp.dll
windows10-2004-x64
3AuthWebhoo...mp.dll
windows11-ltsc_2024-x64
3AuthWebhoo...ch.dll
windows10-2004-x64
3AuthWebhoo...ch.dll
windows11-ltsc_2024-x64
3AuthWebhoo...ib.dll
windows10-2004-x64
3AuthWebhoo...ib.dll
windows11-ltsc_2024-x64
3AuthWebhoo...il.dll
windows10-2004-x64
3AuthWebhoo...il.dll
windows11-ltsc_2024-x64
3AuthWebhoo...ec.dll
windows10-2004-x64
3AuthWebhoo...ec.dll
windows11-ltsc_2024-x64
3AuthWebhoo...st.dll
windows10-2004-x64
3AuthWebhoo...st.dll
windows11-ltsc_2024-x64
3AuthWebhoo...nu.dll
windows10-2004-x64
1AuthWebhoo...nu.dll
windows11-ltsc_2024-x64
1AuthWebhoo...0u.dll
windows10-2004-x64
3AuthWebhoo...0u.dll
windows11-ltsc_2024-x64
3AuthWebhoo...00.dll
windows10-2004-x64
3AuthWebhoo...00.dll
windows11-ltsc_2024-x64
3AuthWebhoo...in.dll
windows10-2004-x64
3AuthWebhoo...00.dll
windows10-2004-x64
3AuthWebhoo...00.dll
windows11-ltsc_2024-x64
3AuthWebhoo...se.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
AuthWebhook/BCGCBPRO1100u100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
AuthWebhook/BCGCBPRO1100u100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
AuthWebhook/CircuiTranspon.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
AuthWebhook/CircuiTranspon.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
AuthWebhook/CreateMiniDump.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
AuthWebhook/CreateMiniDump.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
AuthWebhook/FeatureSwitch.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
AuthWebhook/FeatureSwitch.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
AuthWebhook/PPUtilLib.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
AuthWebhook/PPUtilLib.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
AuthWebhook/XMaxUtil.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
AuthWebhook/XMaxUtil.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
AuthWebhook/maxcodec.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
AuthWebhook/maxcodec.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
AuthWebhook/maxrast.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
AuthWebhook/maxrast.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
AuthWebhook/mfc100enu.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
AuthWebhook/mfc100enu.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
AuthWebhook/mfc100u.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
AuthWebhook/mfc100u.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
AuthWebhook/msvcp100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
AuthWebhook/msvcp100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
AuthWebhook/msvcp_win.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
AuthWebhook/msvcr100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral25
Sample
AuthWebhook/msvcr100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral26
Sample
AuthWebhook/ucrtbase.dll
Resource
win10v2004-20260911-en
hijackloader
%LOCALAPPDATA%\AuthWebhook
%windir%\SysWOW64\input.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack002/AuthWebhook/sandbox-patch.dump | family_hijackloader |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack002/AuthWebhook/msvcr100.dll |
| unpack002/AuthWebhook/mfc100u.dll |
| unpack002/AuthWebhook/msvcr100.dll |
| unpack002/AuthWebhook/msvcp100.dll |
| unpack002/AuthWebhook/msvcr100.dll |
| unpack002/AuthWebhook/mfc100u.dll |
| unpack002/AuthWebhook/mfc100u.dll |
| unpack002/AuthWebhook/msvcr100.dll |
| unpack002/AuthWebhook/msvcr100.dll |
| unpack002/AuthWebhook/mfc100u.dll |
| unpack002/AuthWebhook/msvcr100.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack002/AuthWebhook/BCGCBPRO1100u100.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack002/AuthWebhook/mfc100enu.dll |
| unpack002/AuthWebhook/mfc100u.dll |
| unpack002/AuthWebhook/msvcp100.dll |
| unpack002/AuthWebhook/msvcr100.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=5, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1639, id=1, productName=Unmarked objects,
count=272, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=19, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=350, id=1, productName=Unmarked objects,
count=17, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=9, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=55, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=152, version=20115,
count=5, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=670, id=1, productName=Unmarked objects,
count=47, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=146, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=152, version=20115,
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=84, id=1, productName=Unmarked objects,
count=31, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 18, 2022
CN=Kofax\, Inc.,OU=it,O=Kofax\, Inc.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=164, id=1, productName=Unmarked objects,
count=26, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=152, version=20115,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1005, id=1, productName=Unmarked objects,
count=412, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=155, id=1, productName=Unmarked objects,
count=1, id=152, version=20115,
count=8, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=48, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Mar 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1213, id=1, productName=Unmarked objects,
count=8, id=259, version=30795,
count=28, id=261, version=30795,
count=1, id=256, version=30795,
count=133, id=270, version=30795,
count=1, id=253, version=30795,
count=11, id=260, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Oct 25, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Detects HijackLoader (aka IDAT Loader)
May 9, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=30795,
count=22, id=260, version=30795,
count=1, id=256, version=30795,
count=108, id=259, version=30795,
count=94, id=261, version=30795,
count=621, id=270, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,