d~B:�2�@�� �.�!uaF�����D��I�$Qa�Vi�ٛg�����ϐ��w���#Al 4��C���� �Cٗ�RѤ�@j�XNw�Ψ����A�w��}��Y@����.d��N�[Y��[�d�e�������An.NL�k۠��pM����^����a��G� �)��g*���������l�l���^���4���k"-��6�����l������E<�?cl�F�94*,�r��K����n��c��++�I'��w]zrܬh� �,����&��'������QSDo�Sh���HS4��q�� ��#�)�|ч �S���m���DN%� ���^��Y�v����(M�#�گ?��g�����p� J]�x5��A�7�|d����'u pg�B��Ə���@_B��~�C����3�t������q��Y���o:�I�Z?��e�u�����(Uw�����֗e�憌���q��ի������a��ӿq!M fn�,���U��7��1o�N("�g���& Kj��(��/�ܲhs���n=h�A4!J+� �´DI�������.D��a쎾�*��Ӿ,� �uP� ,$����*M���Yp��i�E0ӿ�N."w �1tSR�k��b���6�Բ���5L����"�p�,���`�;o��;�)�%O4��㘹��CY�]ߡ�P,�F��l�Z��y�@� >M��9�����MgDQ�E��<t;�BM�b�U䁱�� o�W��� �飪)W�gx�.J�" ��>���&]!�;>.|�|d?�=r��r��w�y,]��.Z kooW&p�R��M�[�һ��H�6z����{{;�u�&�Q�G��6��ܝ��P����ő���fHm��5�a\���^M�=��X���D?��]`�r5E�m�z�_�͚W�լk�M�%jU� �+Ь�`��^�EB��b�h2<_[���E���?��z_׀�S'$]�����K���;&=+���"��C��ZX3� l0�eς���>��Dѝ�T�!��V%H����Z�����O+1���/k�U���=� �.�&~Lr���C(��R�����[g����0|��� +�<u��%)0v$_�/T������P�p+������\��0���,V 3F_2�sBE�C�Z�/[ݎ8>�0_��q��mj4�vw��}m����� ��b���s˷�"��<���F `0Z�-�XYo����[٘�s�V��LL�b(@;"��� [?HC����;��!,w7��QCT�J��8�(D5��Q1�dgU� p�+bY�qDp�A ����jwگ Y�7ɀ���;V�N��������J>=q4~ ���s�n�)C��;Jk��B�����TE��h��ѥ�{�VM��-�{ک�&dŢ=|$k����p��qr���դo�3y��HEär�Uy��"����++.]@����1����R�ZǺ����Q/�xs��O�?Yk�F*�|������M�u�)�H��r�2��¼זe�.{���#�F+��h����%#�e~��V�|xg�J�W�`T����_�J�1�[� �����6U/(���Os���� � n�1��J�rQD���y����� �鵁�=3�������z��9�*�K��+q��r����J�I�[��u�x�Z}<��K������L�635�� ?%�# (N=�i"�&A��so ό�R��GqlTT���n��a��J^�h��1߄K�3{z[ʴL��؝H��u��^5&= H|���w�8j��*�E=�i��7�j���A�~��-=8E���LkU�;aI�i*��@�"����� � ����Ȉ��gG�|�MBy��;Q�ukԱ2�K�������}z�l������� ���;��z�w������m�/�q,`V�t(l�ٿOi�$C��労��xA�>�����R�Q���N;r�ay!����{Vg\���AW�t:�R�c�1F;���!�$2���'N�]cX"�K�j�����R�Ӕ��Q��A/��?H�7� ���X�m��zm�s��<�+�s:N�K���'�e[��"��OQ�$g�������^A�["(%iR���tv��cm�<qYR��]��f�U8�R�K�Ńv�W��rtw�4��.��Ԩ��U���mG�?��D��#e�� �v[�`��K��p�l�ά�/I�ѿ�����~�)�#e��V�1MVH�u��ߗ� �a|�(tj!O~(vV��5�J� �9/1���F� �x,��>9u�D��c��h[����N�Bң��a�_#L}*�6d�t�Qw�hz$ ظ͈7x�]T��^Mk�>Ze�!��ܤ�<b� �D���Թ�͌zOb��?�)7�_?�~�T֫��J����|ȸ�}�Z�̮�s^� ���\ݶ����C<%�a�lv�X�ϛ��.�9h�rF�f� M`��Ix6��2��~�Xw��)��3����pmB��f������w��/h��a#W}fG�2C�Ovnb$u��w�j]Z����N�(B^�m�lU0Y`D�:�U��2��B���ϑ2�s�2� �)����?�����Q>x@$c��L�ڮ��7��U9 �W��Ҁ��`�x,��TqN-��[S�&�B}O�Ǒ!�i�V�{�m ����"�0}�H" G_�]��9؍��9c*!�����KD(�����X�:�ZVe0@7nQ�#�C����U�~N400��>#||l�S�{�A��C����<���# �A2��{�����_ߡ��,�R��Y��� ��Y�s��=�9�#AHY�5�,g� =�X�]-c�k1d 9Di+^�Ӗ5�"����H%0$��`8t��?c��1��˶�v�c�Q�F/[���`d��s �@���Q��W�B�[.����3�H'��<A���t�W�P̖��e䒨�*���$��ŭ5���"�z�&��1A��j�q?c�-��;>��=�V"���we�2�*�Cn�hn1*��f 7q}`���9�ř[l��fXb �W%��� ����e���r״c��j�H��ub���p<*��7�8��d,�W�ib��鍪͎�Tu�ԏwD�N�ah��bZ4;g�!o~Z?���{���ۘzg��tWg��ڠi����#ޣ�`���F��MY���_fE�eGbg/=E�_�Hk��q>��<<��If��xb�1�Ѯ�D�S�E��˭�J�9�Nq/H/��d������{�[������Ydܹ<�ס�w�Q�uV̦a���-��N��}s�O3�!�`Z���Y_<N�F��GyC�韫�pzi�)l�U<t�8��Pd�����r�Y����dyC����.*6�4�z�Kј��� ��c�g�%�<T!��W�o��I�I���,��bb y�]'�Q>�@���H�{���������?�D�c&���ٽ�;w���CIS��`�F���q�T��]Č��fp2�p�j�ϞT�mQ]�I{s��<<��Y8���%ps� Q�f�,��2N�G��w{v=/_`��[�v���#�1tSA݄�c�c����"&�)ӧ��=���٤x?V��p��xǘ{���k/�����ޖ��[#�!%��=,o�REb/�?dW��r��A"�h@;d���2l0S��H>u�M+S� �bZ�;��R�Q��ŇzO��A@`�9��`�Uq����L8�X19Rh�]�I�{
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20230703-en
General
-
Target
Loader.exe
-
Size
4.0MB
-
MD5
4eb7ce0c618565984134444f52c63838
-
SHA1
cd49c3ecc78d729637e56afa1dad6d986ab6cbbd
-
SHA256
85881904502937cb395ceb832685b700ace82a175d45863d0b46c08a8c39a95d
-
SHA512
499a0e51d58e694349496c733605c33f7fc86ec44c29189c8c83d8171308af192fdee667d3748f245ab24dd5e5ed463e3fc7f94b8d39ffb40df04012c2261b92
-
SSDEEP
98304:odEq5vcRUFMqB08hSS7ZJCEuRUV3Hab3eV:qEoURUM8hPAWsTe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 367KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 70KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 536KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE