�u�Vb�g�[�4�Pzf 64������ ��dž�yma����<`��g�H��$̲��w��@�/$�#���rei_h�C�X��gۣ?'2-xl��yw_���0V/�m�Y��P�qw�w�p��s�|A��hH��F�P�'���s������k �B������0^�$��^�H�-��jV�o��-�(~?FM��N���X��*���Bf���]����,$���Q���%�����<L�ܞ�HbD:�5�о���w��Y:���w ��^`��m^{VV������>jŝ*d X����J6X����P34 q��%�z��߯}�ka���v%��?�@�T���r�R\;R'���&YѴf��y���=�^z1Ђq�-[.s��� d��6Q��dcC� ����ꡐ�n�J��&ż5b�}l�>�h���o��v�e�TbwY�����_����'fc��Y�Ofk$ژn�!���?��b��?�m���=�aLii`ޒ(f��+q����4� ��\�8�9���|���N} �3���3&�3��\���~�]��������y�A��>O��(�3h|�6a�tA�jHjb���b����S�f*|�ĥx���~E�������u�^�!�m�g; ����G�t~#�#�Q&Ek묂#��:,�^��@`��U�U��Y��Bn��yl��@eJ-[l�0� c �+�>j��?��-����[L�#E��_�O�{��+����5�]"�\*z ����3Qi|`�l�U)�4��8od�*>i�;� �h��(���Ȁ�5(a��ے�kb���'P4�&��Ӯ���X)Z�#��U��zsԵ����p�~��F=��F!T"�eѝ��]��(�V��a�#�Q~� �]S����͗_|O���9�༟�k�B� oD������ 0⯻$��L-Ŷ/Ģ���vԿ���0h��/��ܣ@/��4���Ђ�T�s�KZ����\�U ݇�-��+�_�ߑ�M�Ebuu� t����M��K��_��XX�j��.��!~�=����6>���0L3]�8���Z���2�\(>ӎ���c ���Þ���z's�p+)/�Hg��e�89���.2����+� ڭ�6�w�桔�T��X�ӹK/� }��N_f�����(X$�W:�x���/��+a��(b�&��,�X�@��9��zu�LC��6_zq�9�!8����I�WPV�kҸ1��%}Z���!�g�q�Z��G U�3;�{2��P s��}�wu�ua[1/��x �<��ч_��4���*����2�H˝���v����0z�np�8(�f0>�H^4��?+���:�Ѿ5.���~�g��&$�!t���`&&q��P%�aK��!w�uT��j \(l�<pg!K}u=��ci�f��@�$Sj���0S�l�ե�a�%$�Du��^�`��lWע n����o!�����CHe��.��w������Ͳ'�(�I�u ϡ��'�vm4dׂ�e��]��Iw��0���{?��]:1[B��"����$�待K<��<�#�����R|7������XJ˄ �Y� �����I��.�-�]�����1P�R�.w⒓c=Y/�,7oРH�T��#��΅�Õc��ʒ��eV3��R���QܮxL2��59�����ݖ�å!<����䟪��*��?�w�H�����V�����v��L��Mo�"���}Q����%W�͔���;-�o���'Q�|�����5D�ﭫ]� Jq�I�<#)C�A§��Q��I�jEX�k�<|�G#����=Qt�t��^��_w�#���ߧU=v�D��J�y�|V���.A9����s^���,ګS��]u�%��������:R({4��k��ަ��%��Eh����,ʼ�A��� ��L:H��e#�hG홿���'���/?�%����Hy4��g�%δ�%���3ڔ���5����S�ϋy��GL§UF��qf��sb��f*��gPxZ`^�7��B��\ڥ��џ��M�H��1�'W�T�B1>&�=ȧ4�"�)�&Q. U��g7�N)�����c@��I�t�A>�hm��j��ls�f���P��AP���$L|���--(a��D���JdA���_���E�Dm�9n� �ju��l5�K�T*\�nL�]p1�4T�On��NM�}@sob3`����/K��O��w�-�k�����lz���%��##��k ������s%�Q�9��b��] ��0��0��L:�Qk�/r������4��O�85E(��!���[����0UX2=#= �_V��{���]���#:��Z0�x�1h��/������6��q���ވF�ܛυA�k5q&��8��/G.��E\�.?�h��j���b�N�^���F������[�y]]��� ���5j3Iӟ>�n������L&��+�7wL�����I6C<Woº�:B9�_A��>F�;_~��K����HpNC��FjC����k��/J���`�o6[P��<��qa#J�#{x��x�e����;�ݞ����V�<��:���i���9a"ȠߝFbK�1�w�J��;�����b}+�̤(�~����{��,�R���S��_h�^���l�5�����:SQ7�V��64Q���`sC�%�(�8�/���c�='�Թ���!G1P��!,|�!�bZ���?����in��:c�C4�_u���,�hK��{���vbV�B�)�=���(���|��Q"%���S���`M��I˄��2`���c쮫�u���X�1�j�@U���h���X����x?QH��#u3$ER58� � �D���ɹ�۞^���2=㉧�0�*�0�p5�`����Eu%����QN9)�4�������*���E�DQ��F�z� ����(�4��su(@���|�-3��:�^��bm���uw�5�â1cj���ހY�{'��%�M�����iT8�Jֶ%nQZbs�{Y��\�WJ�o��rt�JIJdp��C};��R�<MԀ�:��3$� �h�3 �ݬSB%��ӡ�4�]�d�z�,m�O���
Static task
static1
Behavioral task
behavioral1
Sample
HSLoader.exe
Resource
win10v2004-20230220-en
General
-
Target
HSLoader.exe
-
Size
9.9MB
-
MD5
f8422c2f4515a096e1d02a1cb2bd3770
-
SHA1
d68749a74f245e5ec8bca249a913948df4681241
-
SHA256
172f37a369e53686834095f20fc7df9f326b41f9013bd5e48c580f6ce6e3cc35
-
SHA512
f32df1dc70bb3a605d132f4741728cbb2281fbe311654e264484f4d0fa8de20f99f81303fca935445fd54cfd71b8cb49e8f5566b4edcda22185c3f2d9b2c84ec
-
SSDEEP
196608:fPVcnH9hQeXc9U5Q9H8Fusa6I+BneeBJhLzKXgj91MhyRgRM:XS9hQec9U5Q18gsJBnlBJNzlTg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HSLoader.exe
Files
-
HSLoader.exe.exe windows x64
30132ab1efa3ebe20c62a4752c35c1ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
PathCombineA
iphlpapi
GetAdaptersInfo
advapi32
CryptHashData
user32
GetProcessWindowStation
CharUpperBuffW
ws2_32
getsockname
wldap32
ord46
crypt32
CryptDecodeObjectEx
normaliz
IdnToAscii
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
ExitProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoGetApartmentType
shell32
ShellExecuteA
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
xinput1_4
ord2
gdi32
CreateSolidBrush
ntdll
RtlCaptureContext
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 758KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5We0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5We1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5We2 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 217KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ