��d%!�=Oy1QI<5Q2_i�'�t����E� 2��0o�'�u��x�x!� �f8\�����ETh�����e�X����gG�B+ϳت��?{���ג�اp�Z�iy����D\]���w� hdX��9�dk�e��K1b��o���w��������phz��`K>���%�����PG4°/l�;%��>��ڻ�=`�r�.�ՠ:��U�qZ7��zǪ*�����?vuC$tA� %�bbҭ�yh�`ԅ� ���z�}'���)��p��0��Y��;e���M��:���Ŏv����֧&����� z��v�i8hէW�Z��Qgo=2��]�M�$������H' �fh���-Sw?N�w���z���A�ඟE��� �%�J-����|塙��W��_\Ř�K]$Ϊ+��`�X0�>KS���K�)A�\�;F�ɃkY�XBVu��k�ۦ�a(U+�ǯ������ǚ����9� ���K%�&6Ֆ��W��t"��fR��-�~�,;=Ͽ/�?Au�k�!���'5�I���k����j�K���x��x�._�-�!Bޅqշ��L��H�A#"'t3��z�O�`dyӘ�V;����m���0�?���՟�?.�Sh�s�rW�ԧ�Ò�Ս���&�J���n�Z����UC�-4][�41�}��]*!d��D��A)�٧AK���5��DgX�n���V���s���,�t�4��G�6�$�Q]p���5 s�J���2t%h=���|�พ�e?��� [v�`6�N�����gS�q�e�����m�����N�)�Oh��r.�с{-���7�VFp:�ƙ��|T;%��%����ʲG[ФPcx���o9��U�%�1�'���✸�b�& Յpm�5���i���퍜v2��+�)��>�A�\) .���%]����:�eV�8�q�����2����c��ˢܲb8A�P�v�C�����i^���wT��xH\[`A:ݒRrpV�\|��}��JVF���X���P��l�Թw��Kb��D?E"elb��z����V�V @���Jh�^(@��%E�]�Y�1���#�����>���EBr,�����F~d7AnLDK9( ����#�7DQ{I�+Z��-͇��@�J�:˲��]B��N����]}��-\��Y��+�GD9�Ťa�eJϴ���F��9�Q�|D�| 6�:��x\�9��\��_��RU2;�IIK. �����[J�%������N�8�^7s��N,��gi���_� |1� (���:�j�[ 2F3*��rۨ�[AOBe3�^�%o�Ģk��I�Ҕ����� �z3���6���ݪ\N��+Ȯ�r�WM�iL�\!�І�����|g>A#������)T?�o�2��]�)T�tys҇һ)�ru.g��J0���]�u�_�'��>�잏^�����5ғB�G�����Ȝ����}��C����{_{��X��Дh=�cꗣ>���@g�3 �ɒ -��OÈؓ��x��rN)��<�yP�G0�N�c������r�3�R��/�u@��|��6ŕ�#�����{����p�D ����o�P�����H~�Kb����=�O��p��p,�|����0h�5 >'����پ������MPMru\�e��?�)6P2&�(�����C�H����\Íh!$�<��hR(`64�QoN�(��E*5wD������e���Cs�`���fk�f��jpz���}5!1�ܙ���u� ���o:�;��:��j���fp�c�M�ۋ�I�P{���g�WɵK�f'4��s{�P��-�X�d�E �:���Ŷ�룅}郕$��^��Ԕ��g ��5R����D�����0��3�2���@�C��C&6�!뀺��Ϣy��2n�@)�2�h�3_����z%A���;U�� PK����eew>�։��_��[�=�ƽ����ɿ9��W4D7����I��"�&����n�Z�����q�B��Ea�a?���{�j�H�k��D��� �l������Vd�WW���������y��f���Y��6�*J�upYW<Fl�{O�F���ǣ����LY���|�1� *�$ˆ�#��/J��RW��?�J|)�������gęo�2�2֧���3�e���p�;i{��W�ؿ�� O D;�gט�� �g�(�T��$�#؏ �!\m��v��+�R�l���(�#F0���qN~��e�� ����h�)�vC �4��K�i�Q� C ������%��MBV%Y��]8� �� �G���S���w���ͣ>���ꊷg��l��[�=���!����g���ʲ�����#R�aR����Z[��r/�lq��eg1����=f)�Y`�"��o�H&�Pe��:�uPSn!��J<`l��ː ����)t��)��=%�0Q cM�v���beK����*/�������3Q�t�:u*��K釿�����Aga�:\[������1��r��7��ȱ;�����,C�`�����:j�h��ӓ����>k��b�i�-���=u�r�*6�3��~�Y�:.ŵ�U�T��jH��A�bi+0X����_α�j��FY[*+���$�������f[��]&^KZ ��#�3D� � ��w&O�� ��Zmu�ߤBh����_J����k���������D�Ѝh�{t�C�A?��Lb���5��i#Yyp>�6���L�@���("�]%���O��Z8��s�rum�^��Ӥ`�ᎇr�%l$ ��\�&��/e�Lf��?\/�; ��>���B`^����&��ZTvޔ��D����s`�'�B�Z41rHjwH�����(��N�9����3g�����d�j醥_я�����Հ�{Obd|r)��L.�<o( �5����1>A�*�{G�Z#�V\`|)��9¢@�D����(���ڐN2&�Hgr$����<�V[O�o�7?Lv�ȕ��� ��8��ؤ���I�n@@�6]���Pa��d/$���?�� d��Q0���X~�lЀ��@�ۋ��Ӣ?}���䳌fdN^n�M��L�Om|!:3���8QP���wk�Džo�0� Q���Iՙ�_ꥺw=�i3�A�1�v�"�@1�@?&°ƕ%:����U�Ȟ~�j/K\�� �u��L�k�����.���?^;��9���f1�P�� 1�� 8��N�6�¤�"��H���X܈+p������d�#jDn��Kw� �����J��(�ʔ�������,����̉�#���U�F�֫��Uuȁ��L�r1�y�����4��P����pC{���G�poq�� �LM���R)͟?U
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20230621-en
General
-
Target
Loader.exe
-
Size
4.7MB
-
MD5
b403e78d3da29bcc369859b632cb08a4
-
SHA1
9b2b743e789eeba485a07386b73d2e5d8829f432
-
SHA256
ee76e6fd6cd75c77a5e4a9827620e64c6d542b9d9e9833a09a29e30d8089f119
-
SHA512
6e70571660b64ce5c89728b1cbba42b1763fc53362bf1a5dc64411dbac23f545975a6a3716b9ea995f7e50d5baa340a0a08a15e819803ebf14ab11c9d3e7202f
-
SSDEEP
98304:kUdvYEuQ37FrJ/vHN01/vnZvll5Cy5wyf2o:kcvhu87/nHq5wy5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 395KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE