hookless_original_gui[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hookless_original_gui.exe
Size 2.6MB
Sample261026-xtv3esvy5n
SHA256 1dd21fd10ded116fc5b85f53b020c957bed9e83261189ae38bac0a54e34a1bec
MD5 71de76fdbd2c6b5318d107ec38ea3148
SHA1 de15494a772298a26a36bd066bf699735983df8e
SHA512 8066c45e0040b6b0167d60e8f2cc9c1fc0ffd73532e307b3bb02e074862406419f16acf2cecc58feccaccb36b9f9a7f76da63f1dc88ef49103d149704f6995fb
SSDEEP 24576:5/EaB0HwZabTQ3sAoSPYwPpDnEvPXnIJOgDTNZqiPvR8O3pLy5y:5/RBkvyXPYSnEHXI88NvRtx
TLSH
T118C58C07E61246A9C476953489E2E33AFB717C745B31830B26DD3E336EB3AE05D99381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hookless_original_gui.exe

File Explorer

hookless_original_gui.exe

.exe 2.6MB

hookless_original_gui.exe

IMPHASH 85b1c2a30521df0a429d0ccca3fc2d79
SHA256 1dd21fd10ded116fc5b85f53b020c957bed9e83261189ae38bac0a54e34a1bec
MD5 71de76fdbd2c6b5318d107ec38ea3148
SHA1 de15494a772298a26a36bd066bf699735983df8e
SHA512 8066c45e0040b6b0167d60e8f2cc9c1fc0ffd73532e307b3bb02e074862406419f16acf2cecc58feccaccb36b9f9a7f76da63f1dc88ef49103d149704f6995fb
SSDEEP 24576:5/EaB0HwZabTQ3sAoSPYwPpDnEvPXnIJOgDTNZqiPvR8O3pLy5y:5/RBkvyXPYSnEHXI88NvRtx
TLSH
T118C58C07E61246A9C476953489E2E33AFB717C745B31830B26DD3E336EB3AE05D99381
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

621768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA GetStdHandle CreateFileW CloseHandle GetLastError WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW Sleep CreateThread OpenProcess GetTickCount VirtualAlloc VirtualFree VirtualQueryEx GetModuleHandleW GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage CreateProcessW GetExitCodeProcess GlobalFree GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile GetModuleHandleExW ExitProcess ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GlobalLock GlobalUnlock GlobalAlloc RaiseException RtlPcToFileHeader HeapSize SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId RtlUnwindEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent RtlUnwind GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW TryAcquireSRWLockExclusive FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx

user32

SetClipboardData CloseClipboard OpenClipboard GetClipboardData GetMonitorInfoW EnumDisplaySettingsW GetWindow FindWindowA SetWindowLongPtrA GetWindowLongPtrA SetWindowLongA GetWindowLongA GetWindowRect GetWindowTextA UpdateWindow GetSystemMetrics SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExA UnregisterClassA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA PeekMessageA DispatchMessageA TranslateMessage EmptyClipboard MonitorFromWindow LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetAsyncKeyState

shell32

ShellExecuteA

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

timeBeginPeriod

d3d9

Direct3DCreate9Ex

Name

.text

Size

810KB

Virtual Size

809KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

890KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

889KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rcal

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hookless_original_gui.exe

dwmapi

kernel32

user32

shell32

imm32

winmm

d3d9

generic