��a\5Y6�d����C��da~tB��Y5pS��@Q�����0�E~���Z���(�$��S�]�Q�k.��q�����D=����B^���%�e�G�����ꕙ�{�*�y���N�i`���^�&�0=��D��p!xv�T���tQh�|yl���?�3�B�]4��s-/�!�7�u�UD��Ak=i�>��k�aY���dw�G*Rɛ�0G����_��ӤJ*��b�V������t� t�HcT1�bD�6 QEuIol�.�E�������Dy6}J��M:a�]��(��TӃ)����Z{�}���z��R�gt���1�-�I-n(�� r��EZFr {�B4�0k�R�t����Ǚ9oDwW��cJ�����5�օEYHJ$�T�w�Cw��gat�+�g�����g�����e`��w����QnU�Mydm��9�7>�Rz/����n�����!���+OlV�Ũ�P��ʆ��>b��5��A��51D91���m]�3�%M(-�;��SBl�v���A���A�����F�!�4&:ͦ��� ��W����_�t��:6�W6��B��9��L|4�����!�{.Ta�9�q4�7T0`���6?\��o�Q�B�U���2�?g��ї�Q>���[���]U|����P�� O}�/}��C�Ԓ�r\=�c�I(��!�{J�@��$�+�ya2f�{���l}0���E\Ë��ԛ7��Ƚs�����;'�rf=8.�� ��u��8,��S�[�YTu�&S�&6�� �O.����}�l�昉�����A$(d���m ��g��?�8������!:7�D�a�B����}c�YVʗ2#���[x�mF��K�3��.�u�����:�ź���G5�x0ex�Dn��K�{*NC�]o�LQ��{y�5��Y~I>������;e��/������֥A��1�����,U��Z�vtO��u�)�73�?� �71�'b+���5�d���%��T�fW~T��)���'S(]������k%���|�Z��6$��l ����+���;�2�='�\���VՅ5�uF�j��wx\�?��k�i��O+��8.��)æjN�fX��%n\_c1���e�U��������������TԻ<�W<�?�.Ib�rN�h @l��R*�н�}�=�w� R��L��{!��P7a��ޕv��Dm�T�����B�_�� B_��ō�zj>uNʹ���ڍ��x��ы.�p.�o�^S��mõ���Hɧ�s���9��L���@ӝ�u�!��g���a=CT�ϳq_��g.������tE��a%����- �S�k�Ɏhs%�4�����+-e��w�#�e�@ ���=~TC�@����������VL�J �st������\�F��M�ޒ���ƹ4h������T��y�U�ǝ��S��[A5{dzm��rQ� {�ZG�C�|����JK<��?ڽhV���Tg�(�/���N) ��#&3v� � Ї�q$s.(����ɔ����6^/^�MW�̬��ńZ�O/:(/�!�y ~L^���1B���#E���0����fX�m�ƌn��l�2ͥ�P����ý�QP�I�ԗ��Df�s��,�IIyJ�G�~:��<8L�9Ās�9��� ������R��:�1"�O�&82|Y�>�>j�}̿@2��,0�^~ �:�k3?]�����I;;D�{��@B)MIw��r:��jӮ��H�t?��%���:[(�1sj�瑎��H�%y�mY��52 ^Ҵ� \��Uo\zj� �E��p�O*=�%�����,��&g)��1۪d�P7 N�$!Ҷ��\)yj�57��*���E�A�m����;C�$�� kv��/Rh{��D�{$!�,���ƠA�H�0�}!��s��K^��U4ج�XI�_�qg!,��֑��Q���`g֮Z�(���� ���a}z�۷n �H�ZA��r��H�~�?��HI�f´Ӟ��LNL�ͣ0t�9��yf<5���'��`G7 6��.�y��fM��w|�ٮ p!�O�B�G9�9�u}�ߡ-;\Cn��(mӍV:�\�S�_�#���5h�v�K�@��_E�?ĉ4S�:-@C✫�g������mTYbKlq�s�0�57[(�FAt���n�I��������j,9i�.�%�!�p ��ֹ<"�rj���zC�4�����3�@6e�K��'�(�e�FPtSW&@R�����r�5#{��fo;��� <����\�������@��6N��z���c��m2mJ�T�Y����7�B��\e��EE�j+3�)�65"�)(�7'�r��hX�l<siQ#�\����W�e��%4T����l�4^Z��_��P��=|a6�H�O,���#����iSj���k�#�/"��O��Dd,4F������N{���:c���� A2�t�?�Qm��R�(q��� >S��^�GD �S+��E - b��j������u��0rS�C�A˴ �;X6�T3hH�_����S1rn���ʯ�s�/��ya�X��5w�O�,���_�r ��w��ɰ9�ϼgK�D�Ҿ�QRXW�����ل�Lj���W�> !�頻����� 9.Z覒os�q���G��)x��7�,�V�a~�����s6���0ǵ2��1��$Red&�?V��ƛ��Њ��b�x�5���bϬg|�Ç��%� ? v�_+��:�G�f��%8��G$P9���V��'M��1��I���c�� o�r���Ը��\�dpa�Z<[�������LwS&�6�{�yu�����d�bdݘ�|�]�1���������T��p}���ޙ�j�gh_� kT�l^�M�j�rC��e���9��ފ��:fWO8�_-�D�B�;2��PP��Pr=��������&&F57[R��kک&e�{b0j S�_M��(��a9tE��")b�*�Sn<�?�j'��tu�Qu���]���w24<v�0��U�%�M ���bߨ��̨�� �MA/?�RG���vփH
Static task
static1
Behavioral task
behavioral1
Sample
loader (1).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
loader (1).exe
Resource
win10v2004-20230703-en
General
-
Target
loader (1).exe
-
Size
19.5MB
-
MD5
5d26885c2d135fd3b4da7617541f9042
-
SHA1
00b692d159085d035f2bd1fd5abf921179b1c744
-
SHA256
9bc759684ad58bdaeab83d12e9f7f57bc126f30f4373adbcdd7bdb8ec5b46d65
-
SHA512
066dba0d326609c1e98cb51f090200ec7b5ed3b634ca51c8f61fe5c1a3147a1b7c1e70cb5138adecaff79474efd687d90297a33fe79dcf3c25f05e3807af7fda
-
SSDEEP
393216:+B3KADtWxtiww5/8LAQyanKQoJWggTp980o9tJD/o2jlg:+B6ADwt8JrFIKVIAbpD/o2S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader (1).exe
Files
-
loader (1).exe.exe windows x64
352c74bc0719e0df1c5d915a3895302a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
iphlpapi
GetAdaptersAddresses
cfgmgr32
CM_Reenumerate_DevNode
httpapi
HttpSendHttpResponse
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharLowerW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
ole32
CoCreateInstance
ntdll
RtlVirtualUnwind
wininet
InternetCheckConnectionW
dxgi
CreateDXGIFactory
shlwapi
SHDeleteKeyW
setupapi
SetupDiGetClassDevsW
winhttp
WinHttpSetStatusCallback
bcrypt
BCryptCreateHash
crypt32
CryptUnprotectMemory
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vtext0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vtext1 Size: 19.5MB - Virtual size: 19.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ