0h��@2m��q������צ_p�)I���ֈ�n;��@`哣0�y�a�o����8j1��0����v���y1�o�X$b�3~������� ���a�c-:��C���ş|g?3P䋐u79���)3�y��;�-Y8����N�U�я^�A��B:�Y-�� �V����� d��m�JYu`�h����b<W;�8u�*c`aH��� [��nN�p���@��TFw�C��J�SK�`�Ym^p\d�CDH/mܵ��A�Ey�S�hHpň��!=��UC����JS�z*��NM�!}�|�7 N�LOG� 0x��P̦��F�)����"i���6�3��7�Uu�`,Xzz�}��z[�9�La��D�ìȜ� ���?20���䶶.!M��m �Q�h���Z{YP�c5ʎ��5T��֞<�L�^��2����N�:�T��.yS�&7�e�����}�[�a�Hѩ���q��X=*�L �Ty��݉~\�d���������!:c�~�d�Rb̳L�k��]���8�L�y��2X�X�C�fT�&��L��{��k�9�����Ea��l�_��ۿ�6�M��"��@L�����М�lt+Q��T�Z�"��!N;p���H.�:�ߕ��3R��2�m��cz���xC���w4�W{;T)}�|Z3a�����!�{�e�IT��}�tU̩�!։n`�2�X?�����#`B�d�?y��;~�k���b���C��|��Өg+)g^;���ʮ��y�)��Q���@j��,�z$��}�O����dQΐ� ���İ�6����3ǖc�T�x-�qH����� ���m)�m(���uV������ u|�e�N?�Q�9j�����x�z{�d�����$:Vn�}�[��j"�#�}�������q}�Ő�fP��'�"�Ɲ��=E��xp[�+J�RV��������Pf�U��:���U�!�P`��vl����{��+�Z�k�%Bw�� �ޗ�\����_y��h��'��e��,���Я�D���A[�(Y�U�q�\�f�Z�45S�r?bws�Em�Y�Z ��\�/���<�Aw��K���Sr���غ�G��|���'"<�G�ŗ�\��'� A4����� &K�����{aғ�{W� F��W?rE(眫�ӄf�#��,���F]�_ibY�ʯ$Ӽ��_e=$��yK�� �V�@T����k��|�+�V�ZM�ӳW�d C����U�ƭ�ab������+����HA�K)z�Û}��� f��mz�v]8��4S6�q�uv��}g~*]���v+���/� ���q��7��y�i9�}9P8*^E��7��^8��D�Cf���r������_��]k������ߧ�-{��.&�7�3.�K=�����L���-��r5| ����K�ynԼ�2�䯌N&n蘳�] a�s'��?)�N���p��l�k���ᦲ��g��;�`���Z�$2я x�A���ٽy�䄹m�>��T�2H�L@��5��آ0bR�����̿���ǣ:����bZ�'�[���f�/ \JW:X���t���l |�z�ad>u�+Մ�L\�JQ+��MMX��ģ�wp���j��a��ٴFr3>ȓ�ʠ>���x�����V���y� $�-��X��#�S1_��y�!/���|Q�,M9�훢��#�~�),���>����m���mb���E~��9���J+��v0#�z�:��C�(��>t���&:t�o����N��A���g��g�:Yxy�6��b�xH<-���qʓc���3���SI�Z���j%����w���萶����k�4v1~<*��w���g���o�F�j��ӂ�����R�KM},r{i���K�Z7'��{Ҹ��7=��5⒬����D3gsc"��i��&6WZj�%_�!����ңqY�����g.B�Z�@�C�ahϬ�����8�i�h��t�1��{��z�uD���L���^m�rjT�e��&�8>C��v�_$���/"��Ϲx�A��� �xt��W�I};Q�L���!I�윀�í�̕e��h��]��**H�����_����S�Y->`(������x2�E�غ����HE:^Q�@ ^=�� @��pinN�=-��$9�:�%*�h^�o�T6���d?������< �ȵ����)��L۞lSY'�s�����U�Vy��vᏕ�*����"���)�GA�6w���ڼ3 ��v�:�� �,��T��> � l�����^�k82�5���t�������ĭ\ċ������'�P_v0��],,�<��Md���G����ڟ�ݤ�w@����͆d� M<+���i�"yk���TR!�>x�����6��%��Mٚ��ܧ;=_g巙U���g}�-3}u�x�^��4)g&&���Ϣcb!�&�^�h~rP�'���+>5P��V�#PB���>P"���,����!#i�T����v�Ҙx��C{LS�p���͖�Ҫ�kqP�&Q����"PP{=���8���#�B>�:�֝����S��r_ ��A���5tu�I��Y�E��� MTjй&��/q!���'���\��b ~Np���H��&0�o�вl�D�K��1�Y{{�25�GJ:?Ӭd���4��a��� v��Ȍw��<�=p�A���+��%1��h�I��&fȔ���rQ8o����+JR�7��0Ou$�}�*��E����&��]�GkА�C�9�u�6����~;*���^n�������$��5+���+��������-���\|[j1(9"�KW��m)��_F�J��6uV�,9�^�Җz��]C�'ZP�� ɰcA qy�5��E$��"�{�DT�5�n�8d�z'hFδ�YԹ`���o�5�ڋu�,��F�P�\��{�`W�pQ�g:�y�Jd�4�M=�u�iE�d$��o�-_2 �l�b'^#��r�¸A�IbKQ�3��} W|�*��m?�<��������/�42�4��~�F ����,)��?�^�J�|���� \�E2��GO93b.|���x^#���r(�^B7��㱮�,?�`sq��k��X$^:���NUE�5��l���t�=H�i+���H�x��t��\b��t�] �C��ߍ�����s��J����B�"���� �y�A�0�?��З'��W2l��1���fwS5`]��;B[>~�<�A����2��ҡ��K�F�(T�/�z%�0�[rj�ŭ��#?���$����X���q�np��*���O+:(�g|儲���j��
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20230220-en
General
-
Target
Loader.exe
-
Size
4.8MB
-
MD5
55fe98b90b8bbbe6902a0c06b2cbb3d2
-
SHA1
706136d088a40438c3653c0fa9d4b6f94d0fc385
-
SHA256
91dbd2efd3e8e8bcf8475587ae877edbbd5cf94663b31ca8d2d6e29231033bdb
-
SHA512
64e43d346f1f5987d24bb296bd57d23097010a9b9402b5b8ba58ed9cf1617d8cfc3b546a00b2c08488bc8bedd922839bc0da32fb61a16a6835c534f2e518d6ae
-
SSDEEP
98304:eBcpe3bNb4kW9sLiogTTWwmywhdXgikhUB6MRNYo8Yln9dvjZFMJ1:RpySkWuKTh+woUoRmn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 405KB - Virtual size: 980KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE