hollows_hunter64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hollows_hunter64.exe
Size 1.2MB
Sample261024-sdchxsav81
SHA256 56a58a8bbf2cec9a5c7c68129e8863af6181fb51dfc25226f1a756aba66b4707
MD5 43e70644017cb0a03d5d1857848f12c1
SHA1 c7becffdff298566369b77f5c6e9181901253441
SHA512 1a12a9b315d0eae5234e0f8d02af7f8dbadb4125575b346574afdfcab54e02efd1ee4884fa53ecb285be0696b2044a2350a53b29a97bf0b1cb5200c76635d7a3
SSDEEP 24576:AhDRgQu9SwP53HSO7AavEB9fjA46K8Kycm:AhDRgJUwPxH8avi9ohcm
TLSH
T188458D26A26810F8D05BD0B8CC165D02E7F6B44643718ECF17A56A5A2F637E22E7FF41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hollows_hunter64.exe

File Explorer

hollows_hunter64.exe

.exe 1.2MB

hollows_hunter64.exe

IMPHASH 03151909c655b3e2e32bdaa3a19b12c6
SHA256 56a58a8bbf2cec9a5c7c68129e8863af6181fb51dfc25226f1a756aba66b4707
MD5 43e70644017cb0a03d5d1857848f12c1
SHA1 c7becffdff298566369b77f5c6e9181901253441
SHA512 1a12a9b315d0eae5234e0f8d02af7f8dbadb4125575b346574afdfcab54e02efd1ee4884fa53ecb285be0696b2044a2350a53b29a97bf0b1cb5200c76635d7a3
SSDEEP 24576:AhDRgQu9SwP53HSO7AavEB9fjA46K8Kycm:AhDRgJUwPxH8avi9ohcm
TLSH
T188458D26A26810F8D05BD0B8CC165D02E7F6B44643718ECF17A56A5A2F637E22E7FF41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

651336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlCaptureContext RtlUnwindEx ZwQueryInformationFile NtCreateFile RtlInitUnicodeString NtSetSystemInformation NtQuerySystemInformation VerSetConditionMask RtlUnwind

shlwapi

PathCanonicalizeA

imagehlp

SymInitialize SymSetOptions SymCleanup SymFunctionTableAccess64 SymFromAddr SymGetModuleBase64 StackWalk64

kernel32

GetLocaleInfoW GetStdHandle FlushConsoleInputBuffer GetConsoleScreenBufferInfo SetConsoleTextAttribute CloseHandle GetLastError GetCurrentProcess TerminateProcess OpenProcess GetTickCount GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetCurrentThread VirtualQueryEx QueryFullProcessImageNameW VerifyVersionInfoW IsBadReadPtr IsBadWritePtr SetLastError InitializeCriticalSection DeleteCriticalSection CreateDirectoryA GetFileAttributesA GetFullPathNameA GetWindowsDirectoryA ExpandEnvironmentStringsA GetCurrentDirectoryA GetLogicalDrives GetLongPathNameA QueryDosDeviceA GetExitCodeProcess K32GetProcessImageFileNameA LoadLibraryA IsValidLocale FreeLibrary K32GetModuleFileNameExA WaitForSingleObject CreateThread TerminateThread GetProcessId EnterCriticalSection LeaveCriticalSection K32GetMappedFileNameA K32QueryWorkingSet K32EnumProcessModulesEx OpenThread Thread32First Thread32Next GetCurrentThreadId GetExitCodeThread GetThreadContext GlobalMemoryStatusEx GetProcessWorkingSetSizeEx K32GetProcessMemoryInfo GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingA ReadFile WriteFile VirtualAlloc VirtualFree VirtualProtectEx ReadProcessMemory LCMapStringW CompareStringW GetTimeFormatW WriteConsoleW HeapSize CreateFileW SetStdHandle GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation ReadConsoleW FindClose FindFirstFileExW SetEndOfFile FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW CreateFileA FreeEnvironmentStringsW GetProcessHeap SetEnvironmentVariableW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW WaitForSingleObjectEx InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW CompareStringEx GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode

ole32

StringFromCLSID CoCreateGuid CoTaskMemFree

advapi32

LookupPrivilegeValueA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CloseTrace ProcessTrace OpenTraceW EnableTraceEx2 ControlTraceW StartTraceW LookupPrivilegeValueW ImpersonateSelf AdjustTokenPrivileges OpenThreadToken

tdh

TdhGetPropertySize TdhGetEventInformation