�428µΙ/ O:Fr(�\��|��םcuM,q ����}i�<�><���Fz@�v���ً��`^_M6H����R�� �t���֨¹�,g��ICW�U��I��1�n��{��>��U�����u����;�0�N����>8�&� �Er/�z�F�R;lѺ��v̟�o���d��R7�t�.����4Q�m=��)/?=�~ᛌ�)t���@����<[�$q�}|���Bʣ��2e�w�3BƷ][�f� ���U�4�5���ސ��WL�u� Ǖ�'y�C�&�i=��5�-~�p)�WvĜG�XAU�R�JDv�+MO<ϱ ���zxD���wb�����Ƀ�>����T�M(}1����5� b�P��6�v��e�'2���#�Y�W�W�d><K�_��5VXhfN��;r����r�L���ھw���眒�kԉp ��0y�� i�m�.��S���D?ȱ+�0���z��[���wVz:mTfO���Fܴ��T`��:eW�e�ضo;t,oj��\_c�K���H�@�@��7�U|����]F�QZ�q�9[b�qo$7E��s (���~~�_ֱ��ABȚ�a�f����j���T����5꾭SX _.e�;��Ǽ��6q�`Lx�+|��R:�>j��_K�K����'.�*�-J��6���7@:%ů��r0"`�Š�B���V���F+M:u���Y!��5�Ld]T��&wC���R��w�x��� ���7�ǐ���~�T�`X>ݿJ����aҩ��p��D��@�F�{>�>��w�Mg����);z*��A<SE:��t)P������bc%����8$>�B��G��VCTͯ6���:�(���s����$y�+Y3��-�3|���:u������{?I��9�;s��H���b{���ׄ��5��IB�{ݠ�n(�]: ���6��3��8%�܀�����E�!;��۔��Z�mX�B� $���?7�@A���S%�~%�Ih����[��3���#$�i�F��+Ք�v�8�V�S �F'fDk����9]\��HFm�N�p���ӱ&#�'�F�yf��/&�w�� ,7e�wN!˱�� @���wd%�)�!�j�~?�b���i�7_��z���<��I~SF�I�-��P�����$o�љ���J�;�Fz��t =��� � �u�/U?IHQHz��=��l�3Y:n���*��ؖ��\ �\|��������<���֞avZ�<k�ы|��D;�+�8\���x9������aϕ�~��, �n���w��]���3���w�.�vg ��=9��p����'�&��\�g⡒��-G���"e-�� ��WB �� ���G�x�����t�.������(�T�D�XNH�((T�윙.���}�D@)P�'���I�r�dH�XP4w(��洜&��A��֢~F��%#yT�ʢ�Zk��M&9V�37t�E�>ƃ4��dL�o�!.�N� [i�a9��>��ߛx���w�[3܂Af�%�67`�`�|f��8�í�چz��s� v��2�, �;_�\�7C���7>yZ�t0�9lw�U.o�bf��x�;�p�Z�� ��)\u���{� z ŗW��5/���N�5�7Z������V;�B�&����&�����Dϻ��Ԋ=�R����_�֠@���ƺ�3�g�>�.7��ê�Jŭ3�yO��qN�y<�8��5(���� ��Y�qGt��s�����b����c@��q ���^V˗$3��a�|��Dk�x���7����������I ��E)<L����?M ���J?~�V�y�u>�@ҝ�O�:N���ϫ�ڥI�-"��G�J+(��)¥�}��Bu��CE�i���~�:"Y�]�g�X�H�!��Z�{Г*\�T�v�ฬKw���Tֱ&{�h\�?� �{Y�B�*��Ʉ��(��O��Yki���7���O+S�>n���[�Ea���~�@fKy������7~�A�u��2Bk����y534b$�S_��5�vK�P�;H� I繉�LL�D ����X3�Q�屔˭;c~����+/��\�_22#@�c�&e�1�QD�Y<M{���K��0I�� 7��:�k��*���>2Ǩv��"d!p����8�x� �50fF�U��d��[la��h�>�7��M�`K��lBie�ʩR�k��M?o��Z�Ac�u�m��Ź��[��TQs��ش�DA�4��%���*�L�y!�d;��۠��[���G�����D��O ���[�W3��2{�F�4�t��c�?|�X�OKm�6=��2w={l�J��[b��V�x ��ae�!�ڇ��/���ԔX��5�� zE�s �6����Ky�pp��J�"�Wt���3�I{�*M��*�����x�Ӱ�'���e��Z9�Z�U�8��dXη�㎭-��R�!����r ���'��?y��|e%�@�}i �ef��2j�,��%Vz��6��l�`q���[��������5�Yt��~q��O!���Es�6��J��`I�?�����<)s��٤���}�Հ��-�����r��̀�C�~4�F�)�j�Jt�-�#q�cyn��fd�r� jD`+�ssm�c��~-��庤�� ��w ����qHY�S�aS�c��\X�����Ǘq����n6Wa;I�*��qٟ*&��kF��ø��q ����J���d/�����:)~W/�le|BQ�1ƤN���.,N?��������� �w~܅�g���?Z��@u��j���c�����hy�3�z)����0gN/T��k��uD�+��h��O3��3= ���,W=�h��4��h�+���PA#y�E��A<L������ɲy�ꍎN� S&�����9?4z�=��řEJf��At���@ s�r�]��A^˙�`�Ҟ3��J���kƊJ��#����ݛmh�v8�$KN ��a�����N�WNf*h��>�Y&~�`���t��~���j�^ȑ�Su ��)��} ��;n'�译ڰ�^�1���ݞ[�n(
Static task
static1
Behavioral task
behavioral1
Sample
main_loader.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
main_loader.exe
Resource
win10v2004-20230220-en
General
-
Target
main_loader.exe
-
Size
28.9MB
-
MD5
149665685eed48be87fd4bc9ffe8bd13
-
SHA1
8a54b38baa5681c6f1fb9586a80665be41da4df9
-
SHA256
d00cc3ece17860fc02d2d2c3f2300133d8c348fe6470f99f125030a0be24f68d
-
SHA512
b6d5c873d06c3568c11efd2ec0efaf9b9d365fb1ac709b21dbbb0b2aa77cf66980c60eb710568b4c70a656223e1cf7937545e3740ce20c649aae2f2c349b9a66
-
SSDEEP
786432:NWn+0QCmELliN4npvCVw2EIkM56RprSt3NDckoKX4jXQpeow+evs:NWn+0QNELIypaVw2eadDZoKXPeowNv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource main_loader.exe
Files
-
main_loader.exe.exe windows x64
794355671b471bb6cfcb8fa5440d01d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmGetContext
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertGetCertificateChain
ws2_32
closesocket
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-environment-l1-1-0
_wdupenv_s
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 914KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1015KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jit0 Size: - Virtual size: 26.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jit1 Size: 28.9MB - Virtual size: 28.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ