����]�w�]}8l�v��T��#\�ա�|�>@���`�f�H�i>x�fx�]ږژl��+�@�ȒYm̩BG�6w:S�V:2�I���b��"q�˾p6��S8L�mQ�%=�,�L�"�݅Q9W&q �Gi�f?�u ���ی��D*��B<�����k=�\i���z�����d�%�/�#T��d�O��Ii��,�5}�ezr�r\:t.:�$+��F�>0��^5"�2�G���ZG�ԁ��鼇z��4ujT��d��\�2�u��ϊ�#oaghg笎X�ng"����h�h��l����%xz� �M�2���ҷ�J���hP�⎈l0��y�t,qN%��="y�8��7 KU��`��Ţ����o��{���)$v~N������,`|V�+:�4Z��̗�=J�V�����>,9���K��mb(z�m�0�ZV1 �<A*6�2��y�23v�������r��(q>D~��H9mlW�F����� &���V��/(�`@�T�Z���}d �|�۴GZ���7�6�i�R������9���>�����uTK���7�m�|\�T��qRƠ%�#�R���C2&=C���JVr ������e{���5�*�٪s���q�dmȒ,�bl,�1~h��q �Z>�B�!�G�JL�����[�ӣ�����47�y:<������&�Tg���*���D3�7�M�.����$۞<����������Ñ�r��w\���kB��Oi��ٵ�M�[~Ζ���N"+�ol�2m�t�H�uq�\Z��<�, ��y5����*�\��u�P[�2��m�-<�<���܋�*"r��XKl�;���$����$�*%��c����`��--��b���ל;]�鰭.2 �SpxU�����^b`�=Z��� H)l��u{�b�vq��3��*&K)�}]M�GO><�2����5�c����[mG��,�8���NL{�'��L{K\� ���R��Ϧ]r���`z۳��y�'�&䈁6������{���l��D���� /��rg"4��.H�ʾ��*3���Yc7z��}�O蒰�����������X��i5k��U=`�z���*��>�n ��/��ܝp����kR�&��TŔ�]Lꞛ��W���~5�v� �]�L�k�-Z 7蟽|�t8ur�`O��l.��C��l4���K�f 4��*�t@��4|ʸr�ۥ�}��l���$������[۳���������} ����6ޞ©��v���Wa��]6%�e�_f{>n3h~'�~F�{�1��A�F���t���QS�{����߅�?9WQCk]���i��𣕖u@�vG����<�N:�����=/���V{K�g��v6��ED�>L�����U�t��T��G`/.��!����v8;�2C�P,�����q_��dC.o�9�!�X6F{�*q���#zXu�Uv^�����ɤ�� q�+r.��/[_�n����q:�ɣ���%��>�yK�{�p�G��hq=�5�Xg�| �m��<h|zWL^<w�`wO�����[~��qi�ʱ�A�|v�h�?��Q�"/-,*b��;lwP 7��>���r1�sli���"�'wV������;��_a�}�������H��[곺�5�J=��'e�?��߅����m}\�.��r�T�c�k�#\!d(1p�6��a4>�h�V�`\��R�� }��2` ��̳�3��Zn�;����?<�2�$kKv��o鏓Q��.�}y�L8l2 ���x��@���YL 8�T��y���ݭ��b�� A�j;�n��o�~��~(��@������j{�E\�z�į��=l��� �͏7��7���B��+�,/��eOꌰqg.~��t۫�^��7N��ш.�W�4�@�L1!����xo���6V�o��e�МO�Gk���k-Ra1���1 �i�DK; �NN7�B�pW�Bw��|�w���� ��љ ���"�M6���p��&��+�p�e��@��1�����(x�W���2ݢJY���29]"�ǵ$�pݼBFV�@��0ҳ$�i9a�y��M�OG)ą<Ԩ�LG����?wC�V�D����u�?�gK��T��d}}-�m�Vz+k�Q�سw���c����s��xb��c��ۤ2y�Tu�ut<��4��K� �9�끫8�8�Ld,Q"Ba����7뽤�wT�_�lڒ9+rw�Ex��1����Ƭ̮�@`��=۞�F� oi�1M |�v�s����L[�$�� UĐ���z�|4͘�`��r�~��Ys>I�Q�3O��cH�5v٢�/ӈݠ���<w��Xv@흟n,�֤-5�ˍ�gv�=�w#������2��D�(�t2�ǡ9� �p�&x�Jy��9��^X5o�����Ww��k������W���k�X1�jN�j̻�NҀ�7�J��t����~Tk�����;(\�>����S,2F��U��>��O�ή��5�iD����O N�>|'��F«J:�����.�]�M���Qĝg�}���@�.�����1�?�q`��Ӎ�D�b�G m��{*�a�dfǓ��%5�_ݳ����ˬ�e��F���Or�`����� ���:^?JI�i$_�1W�_b����u��yh�G�I<$� ԉ ��e��<�B��lv�§��J��ϐ�L�P��u�<�:��FTâ���L�C��y��G��à�V�Y�"��]&5�>.~S^ەZ˸�qN���y�]�`Ǒ!c��߇��h,�^�ä�6�~��b�U�GDxU�_�0��(� ��@��A�t�=[5���I��y�������v��/b�T{a��$�Ndx�|*�4[�� �����-�R��[ (��F��l��AoO�XW�6�B������V�Rh���2��]���I���,�2KM5��txxK8X��k�p"����\M�>|�6���I�_��|r�ϺL��v�q[V�d�(d_��Z��a11e�AJ ��/�5���U���_�s
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20230220-en
General
-
Target
Loader.exe
-
Size
18.0MB
-
MD5
1ec2ddf147c5344cd3a63c0546ff7c91
-
SHA1
7c04045008547157310c00bd4fe254e79ba4241c
-
SHA256
ea488c5ca12dc9c69c36465f3e9c70ed00c916b89ccfb5c5addf3b21c2db8f18
-
SHA512
bc629cbcfb800008b0df37b51a5caf9bcc1bdc48a5ee562c3c9c561386b806cf1f4877c277c2191dfecc9ec41cccf1525fa5b7f5b44f932e1eaffcb578532561
-
SSDEEP
393216:MF4MaqTsNgra+E9fIwJR5paqvvlv6CVlq4dLsrxBhnWn:XZqKh+E9f7JfpaqHXlqwExTC
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows x64
612e8afb77598c53323490687026d5f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d10
D3D10CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GlobalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
ole32
CoInitializeSecurity
oleaut32
SysAllocString
imm32
ImmSetCandidateWindow
ws2_32
setsockopt
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 806KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 14.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 16.0MB - Virtual size: 16.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ