StartFunc
Static task
static1
Behavioral task
behavioral1
Sample
ccfa86896ffc44125e762009e0301fa662ce58cc87d71e457873d741f43d8d5b.dll
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
ccfa86896ffc44125e762009e0301fa662ce58cc87d71e457873d741f43d8d5b.dll
Resource
win10v2004-en-20220113
General
-
Target
ccfa86896ffc44125e762009e0301fa662ce58cc87d71e457873d741f43d8d5b
-
Size
137KB
-
MD5
80a0d6819d431dbde0661de16f1487af
-
SHA1
c57b6cdc3852bd11adf5f1eb3f5b8ec077037093
-
SHA256
ccfa86896ffc44125e762009e0301fa662ce58cc87d71e457873d741f43d8d5b
-
SHA512
d1802939f331e215be388d8b9187385ed50aea27e73217fba41f413cf101e4ae6ab9d8977e6fde9f8d9221c01a9453a62caad1e3ea9b3e77fd48f4514d95d6ff
Malware Config
Signatures
-
Bazar/Team9 Loader payload 1 IoCs
Processes:
resource yara_rule sample BazarLoaderVar1 -
Bazarloader family
Files
-
ccfa86896ffc44125e762009e0301fa662ce58cc87d71e457873d741f43d8d5b.dll windows x64
da5c6acc98baaabc2cce548d1859eab8
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExitProcess
api-ms-win-crt-string-l1-1-0
memset
Exports
Exports
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ