HackerEyesV2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HackerEyesV2.exe
Size 761KB
Sample261029-zpcrdstt2l
SHA256 de33a29a8bbc83d48df02c3d01768864ec8bd39e9f9f79b2d6f09e949058fb70
MD5 3596768493ffd03b768ff848c67bec27
SHA1 1290c3eaa9d84b4b9d29b7cd83c33ca4050b748f
SHA512 98662a54e7648adf9a9fb5476287d8a1a2107b815f0efe5b7a71cbb1c16b621af28c557373046571f9b8cc95ec521fabe973b1d225c7b6523fb004a3cefa1966
SSDEEP 3072:wirs8dbskQZIFE7DOzUq94d5zPJSHIroZBZ+eGPCwau8dWrEuZMSwfVkkDOUyBjc:wirHik0Zb6bZBZ31mCJkBxFWYbqC6
TLSH
T10EF44666A6A655A5C17BC038D542851EFD6034AA833D52FFA2C18EC07F907F8AF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HackerEyesV2.exe

File Explorer

HackerEyesV2.exe

.exe 761KB

HackerEyesV2.exe

IMPHASH 9d74092ac572ffbb6fc9f80e5d768b78
SHA256 de33a29a8bbc83d48df02c3d01768864ec8bd39e9f9f79b2d6f09e949058fb70
MD5 3596768493ffd03b768ff848c67bec27
SHA1 1290c3eaa9d84b4b9d29b7cd83c33ca4050b748f
SHA512 98662a54e7648adf9a9fb5476287d8a1a2107b815f0efe5b7a71cbb1c16b621af28c557373046571f9b8cc95ec521fabe973b1d225c7b6523fb004a3cefa1966
SSDEEP 3072:wirs8dbskQZIFE7DOzUq94d5zPJSHIroZBZ+eGPCwau8dWrEuZMSwfVkkDOUyBjc:wirHik0Zb6bZBZ31mCJkBxFWYbqC6
TLSH
T10EF44666A6A655A5C17BC038D542851EFD6034AA833D52FFA2C18EC07F907F8AF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

302308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Laa3een\source\repos\HackerEyesV2\x64\Debug\HackerEyesV2.pdb

kernel32

CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo FreeLibrary SetConsoleOutputCP SetConsoleMode GetConsoleMode WideCharToMultiByte QueryFullProcessImageNameW OpenProcess TerminateProcess GetCurrentProcessId CloseHandle ReadFile VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentProcess MultiByteToWideChar RaiseException GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId GetProcAddress SetConsoleTitleW CreateFileW GetStdHandle

advapi32

CryptDestroyHash RegEnumValueW RegOpenKeyExW CryptAcquireContextW CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegCloseKey

msvcp140d

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?uncaught_exception@std@@YA_NXZ

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable

ws2_32

ntohs inet_ntop

wintrust

WinVerifyTrust

vcruntime140d

__vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler __current_exception_context __current_exception __std_exception_destroy __std_exception_copy memset memmove memcpy memcmp __vcrt_LoadLibraryExW _CxxThrowException memchr

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_cexit _CrtDbgReportW _seh_filter_exe _set_app_type __setusermatherr _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _crt_at_quick_exit strcpy_s strcat_s _wmakepath_s _wsplitpath_s wcscpy_s _crt_atexit _callnewh terminate _rotl __stdio_common_vsprintf_s _CrtDbgReport _calloc_dbg _time64 strftime _localtime64_s system strlen wcslen towlower _invoke_watson _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _free_dbg malloc _seh_filter_dll

Name

.textbss

Size

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

609KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

631B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HackerEyesV2.exe

kernel32

advapi32

msvcp140d

iphlpapi

ws2_32

wintrust

vcruntime140d

vcruntime140_1d

ucrtbased

generic