loader_beta_bl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

loader_beta_bl.exe
Size

7.0MB
MD5

1a57be8f470c5cd32d932cd521525f13
SHA1

b8c7037ee8ec78eafbeae886b5263a8feb0dd3ac
SHA256

f85e4a5be4b8cead60ad9efdccd33d90427aaec0822b368968aa3e264ea92ada
SHA512

f7875927ac9914f4c9973aad473123977c9791ad94ba50f9cb4b172d77f3b4f9c9528a20b39d9403ca1fff2a01fa130df3c11fdf2065cb8d66d230f26ea70931
SSDEEP

196608:w/Erw23IJ7xP6BTgrEcQ0RLgHqm2hcqxIKwj7RxAEIepVU:KErw23IJ96J4QZGJxIKwnVc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader_beta_bl.exe

Files

loader_beta_bl.exe
.exe windows x86

7bf6d4dd28f1b09621180f9e1495dfad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostname
sendto
recvfrom
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
htonl
WSAIoctl
htons
getsockname
listen
bind
accept
WSASetLastError
WSAGetLastError
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
ntohl

advapi32

ReportEventW
RegisterEventSourceW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
DeregisterEventSource
OpenProcessToken
GetTokenInformation

crypt32

CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindExtension
CertAddCertificateContextToStore
PFXImportCertStore
CertOpenStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemory

kernel32

GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MultiByteToWideChar
QueryPerformanceFrequency
QueryPerformanceCounter
HeapFree
Sleep
LoadLibraryA
HeapAlloc
GetProcAddress
GetProcessHeap
CreateMutexW
GetLastError
CloseHandle
GetModuleHandleW
ReadFile
WriteFile
CreateFileW
ExitProcess
GetCurrentProcess
GetVolumeInformationW
EnterCriticalSection
VirtualFree
VirtualAlloc
TerminateProcess
LeaveCriticalSection
GetExitCodeProcess
LoadLibraryW
CreateDirectoryW
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
FreeLibrary
GetConsoleMode
SetConsoleMode
GetEnvironmentStringsW
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryA
GetModuleHandleA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
PeekNamedPipe
FreeEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
GetCPInfo
CompareStringEx
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableW
ReadConsoleA
DeleteFileW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringEx
DecodePointer
EncodePointer
InitOnceBeginInitialize
InitOnceComplete
RaiseException
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetExitCodeThread
SetEndOfFile
SetFilePointerEx
GetModuleFileNameW
GetConsoleOutputCP
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
GetFileAttributesExW
HeapSize
WaitForMultipleObjects
WriteConsoleW
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
IsChild
ClientToScreen
GetCapture
ScreenToClient
ShowWindow
GetDesktopWindow
PostQuitMessage
RegisterClassExW
UnregisterClassW
CreateWindowExW
MessageBoxW
DestroyWindow
GetWindowRect
DefWindowProcW
TranslateMessage
PeekMessageW
DispatchMessageW
GetProcessWindowStation
GetUserObjectInformationW
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState

shell32

ShellExecuteW
SHGetKnownFolderPath

ole32

CoTaskMemFree

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

xinput1_3

ord4
ord2

bcrypt

BCryptGenRandom

normaliz

IdnToAscii

wldap32

ord200
ord301
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143

Sections

.text
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 901KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.d!e
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.7/f
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.!CS
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7bf6d4dd28f1b09621180f9e1495dfad

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

crypt32

d3d9

d3dx9_43

kernel32

user32

shell32

ole32

imm32

xinput1_3

bcrypt

normaliz

wldap32

Sections

.text Size: - Virtual size: 2.3MB

.rdata Size: - Virtual size: 901KB

.data Size: - Virtual size: 60KB

.d!e Size: - Virtual size: 3.1MB

.7/f Size: 6KB - Virtual size: 6KB

.!CS Size: 6.8MB - Virtual size: 6.8MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 112KB - Virtual size: 111KB

.text
Size: - Virtual size: 2.3MB

.rdata
Size: - Virtual size: 901KB

.data
Size: - Virtual size: 60KB

.d!e
Size: - Virtual size: 3.1MB

.7/f
Size: 6KB - Virtual size: 6KB

.!CS
Size: 6.8MB - Virtual size: 6.8MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 112KB - Virtual size: 111KB