Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20230621-en
General
-
Target
loader.exe
-
Size
396KB
-
MD5
ec32b2ffc18d1a59b5863771fa3a7744
-
SHA1
f8c74e9b2454f2a56146fb5384d4022972f01178
-
SHA256
09511f88f02c79574f1df046e41dd43067fa9ddddd69374e9f29771df586aedb
-
SHA512
720f1885d5f5d938d7ed34cd48ad7d7c9d09cbc3d8dfc2ba0bdd5c91bd0203845908813ec9bdc6b25f72a00b3c681eb6271787620b3a36f2ec66caea7da06f8a
-
SSDEEP
6144:JVppu9qI6jdImOyFIKzR83ACyUD4MgN6sCuikmzCYnTT+pMnB8Ntf01G/u:hPI6BImOA8gu4MeFkCYnTUUB8Nq13
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows x64
a2d7001da372da2c4bf091a720c8ac7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesExW
GetProcAddress
AreFileApisANSI
CloseHandle
GetFileInformationByHandleEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
LoadLibraryA
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetCurrentProcessId
CreateDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
PostQuitMessage
UnregisterClassA
PeekMessageA
TranslateMessage
UpdateWindow
DefWindowProcA
MoveWindow
MessageBoxA
ShowWindow
GetSystemMetrics
RegisterClassExA
CreateWindowExA
PostMessageA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DispatchMessageA
GetWindowRect
DestroyWindow
shell32
SHGetSpecialFolderPathA
msvcp140
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
_Cnd_do_broadcast_at_thread_exit
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Thrd_sleep
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
xinput1_4
ord2
ord4
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
memcpy
memcmp
memchr
__std_exception_destroy
memset
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_terminate
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_crt_atexit
_cexit
__p___argv
_seh_filter_exe
_set_app_type
_c_exit
_get_initial_narrow_environment
_register_onexit_function
_register_thread_local_exe_atexit_callback
_initterm
exit
_beginthreadex
_invalid_parameter_noinfo_noreturn
terminate
_exit
__p___argc
_initterm_e
api-ms-win-crt-stdio-l1-1-0
fgetpos
fwrite
fread
setvbuf
ungetc
_fseeki64
__stdio_common_vfprintf
fgetc
_get_stream_buffer_pointers
fclose
fflush
__acrt_iob_func
__p__commode
fputc
ftell
fseek
_wfopen
__stdio_common_vsscanf
fsetpos
_set_fmode
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
strnlen
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sqrtf
acosf
floorf
cosf
ceilf
fmodf
sinf
__setusermatherr
Sections
.text Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 130KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ