hookshot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hookshot.exe
Size 175KB
Sample261110-w46fgacy21
SHA256 d085bd291c5e68ab33b88b0a03be3671a76987b0998b9a881b2d36390175b09b
MD5 a3c73ed0d0bdaee488257da9c9846860
SHA1 8a2b89e192fc34bfb4bdb8de9e2d93ab2bc6ef1d
SHA512 bb929cfc1ce8ee5238b2300bf4a4cc170613a1e222906de866a4f82664550d94f12f81683a93c8cab48ef15d5633f9a996962be4e9caeb6e27eb1060ad33c55b
SSDEEP 3072:0Sg5GpvTyPxWkwvcih3SpGfxf0+jTtq///deEHi7YJtpTb3u:0Sg5GpcxWkEh3SYfxfhft0/Bi0Jnb3
TLSH
T13B049D429B21CBFBEE628B36D4BB0224E935F0010B59ADCB2E4505107F63BD54E77B86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hookshot.exe

File Explorer

hookshot.exe

.exe 175KB

hookshot.exe

IMPHASH 2a8d1065c02522662c17acb3c4d0331f
SHA256 d085bd291c5e68ab33b88b0a03be3671a76987b0998b9a881b2d36390175b09b
MD5 a3c73ed0d0bdaee488257da9c9846860
SHA1 8a2b89e192fc34bfb4bdb8de9e2d93ab2bc6ef1d
SHA512 bb929cfc1ce8ee5238b2300bf4a4cc170613a1e222906de866a4f82664550d94f12f81683a93c8cab48ef15d5633f9a996962be4e9caeb6e27eb1060ad33c55b
SSDEEP 3072:0Sg5GpvTyPxWkwvcih3SpGfxf0+jTtq///deEHi7YJtpTb3u:0Sg5GpcxWkEh3SYfxfhft0/Bi0Jnb3
TLSH
T13B049D429B21CBFBEE628B36D4BB0224E935F0010B59ADCB2E4505107F63BD54E77B86
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

comctl32

InitCommonControlsEx

shell32

SHGetFolderPathW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

_wcsicmp memset strcmp strcpy strlen strncmp strpbrk strtok wcscat wcscmp wcscpy wcslen wcsncpy

api-ms-win-crt-environment-l1-1-0

__p__wenviron _wgetenv getenv

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _exit _fpreset _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-private-l1-1-0

memcpy memmove strchr strrchr strstr wcsrchr wcsstr

gdi32

CreateFontW

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetSystemMetrics LoadCursorW LoadIconW MessageBoxW PostMessageW PostQuitMessage RegisterClassW SendMessageW SetWindowTextW ShowWindow TranslateMessage

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitThread FindClose FindFirstFileW FindNextFileW GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetStartupInfoW GetSystemDirectoryW MoveFileW MultiByteToWideChar ReadFile RemoveDirectoryW SetFileAttributesW SetUnhandledExceptionFilter Sleep VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hookshot.exe

winhttp

bcrypt

comctl32

shell32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

gdi32

user32

kernel32

api-ms-win-crt-math-l1-1-0

generic