Static task
static1
Behavioral task
behavioral1
Sample
ProjetHazeLoader.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
ProjetHazeLoader.exe
Resource
win10v2004-20230703-en
General
-
Target
ProjetHazeLoader.exe
-
Size
9.1MB
-
MD5
ae7b6204c619667a859d9bd5a909e8f8
-
SHA1
a0640ffc973623b5d2efe22966f9683ba6e4c355
-
SHA256
e7dbae566d1f513efe8680620856c35f9cf4cb6b81f4a671e42d5026c46a283d
-
SHA512
759827eb8b57ea93502dc097ed5ab0370f53a6dad16d717eb395e1c75b8193eea308e2956e06a9bfb3dbeda093a06332c9994eb92b76d61d14822097ad6b556c
-
SSDEEP
196608:ZZVUBxv33WVirEvVc2y4SWdmYjAgMNAxeIuLCIoKE0yCNx3F:ZZE933W66VwQmOenLPoBix3F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ProjetHazeLoader.exe
Files
-
ProjetHazeLoader.exe.exe windows x64
d2b68f5524c8162b0bf5cfa9479f80a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenServiceA
StartServiceA
ControlService
DeleteService
OpenSCManagerA
QueryServiceConfigA
CloseServiceHandle
CreateServiceA
EnumServicesStatusA
GetTokenInformation
AddAccessAllowedAce
GetLengthSid
SetSecurityInfo
InitializeAcl
OpenProcessToken
IsValidSid
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetUserNameA
version
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
kernel32
GetModuleHandleA
Sleep
QueryFullProcessImageNameA
CreateFileA
QueryPerformanceFrequency
DeleteFileA
FreeConsole
CreateThread
CreateFileMappingA
LocalFree
GetConsoleWindow
CreateProcessA
GetTempFileNameA
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FindClose
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
TerminateProcess
GetStdHandle
SetConsoleScreenBufferSize
GetCurrentProcess
FindNextFileW
HeapFree
VirtualFree
DeviceIoControl
VirtualAlloc
InitializeCriticalSectionEx
CreateFileMappingW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SetConsoleTextAttribute
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
MultiByteToWideChar
GetEnvironmentVariableA
UnmapViewOfFile
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
WideCharToMultiByte
GetLocaleInfoEx
GetConsoleScreenBufferInfo
VirtualProtect
FindFirstFileW
GetLogicalDrives
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapAlloc
CloseHandle
HeapReAlloc
GetVersionExA
LoadLibraryA
GetLastError
GetTempPathA
CreateFileW
AreFileApisANSI
GetCurrentThreadId
HeapSize
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
SleepEx
user32
GetWindowRect
BlockInput
MoveWindow
MessageBoxA
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
ntdll
VerSetConditionMask
NtQuerySystemInformation
userenv
UnloadUserProfile
normaliz
IdnToAscii
wldap32
ord50
ord41
ord60
ord26
ord27
ord211
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord217
ord143
ord45
ord22
ord32
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
ws2_32
getpeername
getsockname
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
WSAGetLastError
send
recv
closesocket
connect
bind
getsockopt
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
strstr
strrchr
__std_exception_copy
strchr
memset
__std_exception_destroy
__C_specific_handler
__current_exception
memmove
memcpy
memcmp
memchr
__std_terminate
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
calloc
realloc
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_access
_stat64
_unlock_file
_fstat64
_lock_file
_unlink
remove
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
_stricmp
isupper
tolower
strpbrk
strspn
strcspn
_strdup
strcmp
api-ms-win-crt-runtime-l1-1-0
__p___argc
_initterm_e
_initterm
_get_initial_narrow_environment
_beginthreadex
_invalid_parameter_noinfo
system
terminate
_errno
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
exit
_getpid
_seh_filter_exe
abort
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
strerror
_exit
__sys_nerr
_resetstkoflw
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
fputs
__stdio_common_vsscanf
fclose
feof
fseek
ftell
__stdio_common_vsprintf
_popen
_pclose
fgets
fgetc
_read
_write
__p__commode
_lseeki64
_set_fmode
fwrite
fgetpos
setvbuf
_fileno
ungetc
_setmode
fsetpos
__stdio_common_vfprintf
fopen
fread
_fseeki64
__acrt_iob_func
_open
_get_stream_buffer_pointers
_close
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtoll
strtoull
strtod
atoi
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
shell32
ShellExecuteA
Sections
.text Size: 509KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 8.5MB - Virtual size: 27.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE