Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
loader.exe
Resource
android-x64-arm64-20230621-en
General
-
Target
loader.exe
-
Size
20.6MB
-
MD5
50596b0be867e03f1c1b05d7673e02c6
-
SHA1
ef301798914bc14a88ece60ff56d060b39bc08a9
-
SHA256
a06964f9c51343778b899fb4bf95e2fdd9148d441f0f2a913275b7f82a0e5f38
-
SHA512
ad35de8a163fd7ee23ab189f65816d65f58d22f7f8412b10588610bb737f1e079febaf27cd1f2e833cf823bf3f8c44ca57eafaff17f46378664560125dc5842e
-
SSDEEP
393216:UX06s7Dy0CBEdMngCaBAT9sJUskgIUto6fT6LF:UX06s7DXCKdaaBAJ+T2Ao6+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows x86
3f4a06f5800da864fe2a735c2fb25e9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
dwmapi
DwmSetWindowAttribute
user32
DefWindowProcA
ole32
StringFromGUID2
ws2_32
WSAWaitForMultipleEvents
crypt32
CertOpenStore
advapi32
RegCreateKeyExA
ntdll
VerSetConditionMask
wtsapi32
WTSEnumerateProcessesA
urlmon
URLDownloadToFileA
wintrust
WinVerifyTrust
iphlpapi
GetAdaptersInfo
dbghelp
SymUnloadModule64
version
GetFileVersionInfoW
kernel32
InterlockedPushEntrySList
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
imm32
ImmGetContext
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 638KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+U- Size: - Virtual size: 13.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5@E Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fD} Size: 20.5MB - Virtual size: 20.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ