HistorySenseLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HistorySenseLoader.exe
Size 20.1MB
Sample261102-whtjsaby6x
SHA256 0ee0ced6340747c08b04bafea4ee0206407b1ba6741ec93ea1cbb0c338c1fd9b
MD5 a3e32f45dbabb2dceb6439a72047b5ea
SHA1 97285579bd1c4e4afe51ae544fae9595160d68bc
SHA512 2fd8a9e5259710209ea19611ad934603aac1435481ba605705ab916ebde2bb414f31e38cf0e001c5698cccdffee36faef9f8e4ad036db49010134f5eb447dd4c
SSDEEP 196608:4z2wb3O8c0A6uXns6Fgb931GU6AY2ezECOI:4zf+8c03GsP6asrO
TLSH
T119273A12E6058C61D05DA1F8E05D2D9924A98C13CF552EC3731CB94EBFBE1CE2A7E4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HistorySenseLoader.exe

File Explorer

HistorySenseLoader.exe

.exe 20.1MB

HistorySenseLoader.exe

IMPHASH 1f9d8b32bd350a52951dd94fd98b744f
SHA256 0ee0ced6340747c08b04bafea4ee0206407b1ba6741ec93ea1cbb0c338c1fd9b
MD5 a3e32f45dbabb2dceb6439a72047b5ea
SHA1 97285579bd1c4e4afe51ae544fae9595160d68bc
SHA512 2fd8a9e5259710209ea19611ad934603aac1435481ba605705ab916ebde2bb414f31e38cf0e001c5698cccdffee36faef9f8e4ad036db49010134f5eb447dd4c
SSDEEP 196608:4z2wb3O8c0A6uXns6Fgb931GU6AY2ezECOI:4zf+8c03GsP6asrO
TLSH
T119273A12E6058C61D05DA1F8E05D2D9924A98C13CF552EC3731CB94EBFBE1CE2A7E4AD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\skeet-master\build\historysense\HistorySenseLoader.pdb

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCrackUrl

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptVerifySignature BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW

d3d9

Direct3DCreate9

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance

user32

TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow SetWindowLongW GetWindowLongW WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW ReleaseDC GetDC SetForegroundWindow GetForegroundWindow SetCapture GetCapture GetKeyState SetFocus BringWindowToTop IsIconic SetLayeredWindowAttributes IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadImageW LoadCursorW GetSystemMetrics ReleaseCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

kernel32

SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation GetCommandLineA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent GetCurrentThread GetStdHandle ExitProcess GetCommandLineW ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW TryAcquireSRWLockShared AcquireSRWLockShared ReleaseSRWLockShared CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFile2 CreateDirectoryExW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle HeapSize WriteConsoleW FreeLibraryAndExitThread VirtualAllocEx DeviceIoControl AreFileApisANSI CreateFile2 GetTempPathW CreateFileW GetFileAttributesW GetFileInformationByHandle GetFinalPathNameByHandleW GetVolumeInformationW GetVolumePathNameW ReadFile SetFileInformationByHandle WriteFile CloseHandle GetLastError PeekNamedPipe GetOverlappedResult CancelIoEx WaitForSingleObject CreateEventW Sleep GetCurrentProcessId GetTickCount64 GetSystemDirectoryW GetSystemFirmwareTable GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW MoveFileExW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW DuplicateHandle GetCurrentProcess TerminateProcess CreateRemoteThread GetExitCodeThread ResumeThread CreateProcessW ProcessIdToSessionId OpenProcess SetEndOfFile WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFreeEx UnmapViewOfFile IsWow64Process GetModuleHandleW GetModuleHandleExW GetProcAddress LocalFree FormatMessageW QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA VerifyVersionInfoW SetFileTime SetFileAttributesW GetFullPathNameW GetFileAttributesExW GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW

shell32

SHGetFolderPathW SHGetKnownFolderPath

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

549KB

Virtual Size

581KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

409B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16.9MB

Virtual Size

16.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HistorySenseLoader.exe

winhttp

bcrypt

advapi32

d3d9

ole32

user32

gdi32

imm32

dwmapi

kernel32

shell32

generic