ArcticLiteLoader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ArcticLiteLoader.exe
Size

719KB
MD5

d63da49eb6477d4454166f1e41742205
SHA1

ff9df27d92e1ca61a4c2d43fb4f3a3b655e2dc9b
SHA256

598e606287319b7e4c0158f99dcb0577789492f53ceb12bdc4f085cb125ddf9c
SHA512

ece24dce9ad30256815588ee485ecc7d47ced82e2ffa17a154a8865c84854df1972f1e9dc7df53977a94b87b9cda97b6375d48171b66a65366dba7521108b0b4
SSDEEP

12288:CCQbKYbT3UvmgCMu/2XhxGQZ4OCTsLDBKsgTD76V+eXaougXfA2iYp4xBTFlx:CTb0vIMHx1OvC4T+6ougPA2iYqxHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ArcticLiteLoader.exe

Files

ArcticLiteLoader.exe
.exe windows x64

f79f8ff17169d5f6953da07dece6b7bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterEventSourceA

kernel32

GetModuleHandleA

shell32

SHChangeNotifyRegister

user32

MessageBoxA

Sections

Size: - Virtual size: 554KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE