Bo2 Loader[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Bo2 Loader.rar
Size

47.6MB
MD5

d3ec330ecc1f032f2443f61aaf90c7f3
SHA1

bf04fe81719c30d3432d428f39053b31027d8e45
SHA256

4588f48b173ca4df96e3f277dfe9f48e69f3179a797c4f76bd26ccbeb7a0d65a
SHA512

7ecbc74e426efd2073303a7fb27add39d40edbe7742a91c890a7c3e6195ad4d3fb11ad117e6335bd40e9a6d88c58a0a3c09c0dd42f6a85f586e39ee2af690df7
SSDEEP

786432:KbSfI3LCI4bVt/07sxHBGFMF/fFhd6rEFMZHS/BMbXEKd7+lGoQIErbK7WlJ74+E:0SaCIKD/07Shv/fFhd6wMZHS/pk7Hfz4

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lucid(1)/Loader.exe
unpack001/Lucid(1)/SecureEngineSDK32.dll

Files

Bo2 Loader.rar
.rar
Lucid(1)/Loader.exe
.exe windows:6 windows x86

5ff6d37fe3c88fc8330eb83dd28fc951

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

freeaddrinfo

crypt32

CertFindCertificateInStore

advapi32

OpenProcessToken

kernel32

GetStartupInfoW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DestroyWindow

shell32

ShellExecuteA

msvcp140

?set_new_handler@std@@YAP6AXXZP6AXXZ@Z

d3d9

Direct3DCreate9

bcrypt

BCryptGenRandom

userenv

UnloadUserProfile

rpcrt4

RpcStringFreeA

imm32

ImmReleaseContext

xinput1_3

ord2

vcruntime140

__current_exception_context

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-heap-l1-1-0

_recalloc

api-ms-win-crt-stdio-l1-1-0

fseek

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-environment-l1-1-0

getenv

Sections

�1F�@@�@
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

R�[�g��+
Size: - Virtual size: 520KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�j�ȥ$Q!
Size: - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6@�к��V
Size: - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�M�x�S�r
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Ihv��-&�
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

<�g�Äl�
Size: - Virtual size: 42.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

\TVZ{��
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

�Ҿ�*s�[
Size: 47.6MB - Virtual size: 47.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

�)�`�IJ�
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Lucid(1)/SecureEngineSDK32.dll
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 929B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ff6d37fe3c88fc8330eb83dd28fc951

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

advapi32

kernel32

user32

shell32

msvcp140

d3d9

bcrypt

userenv

rpcrt4

imm32

xinput1_3

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

�1F�@@�@ Size: - Virtual size: 2.0MB

R�[�g��+ Size: - Virtual size: 520KB

�j�ȥ$Q! Size: - Virtual size: 353KB

6@�к��V Size: - Virtual size: 488B

�M�x�S�r Size: - Virtual size: 84KB

Ihv��-&� Size: - Virtual size: 3.7MB

<�g�Äl� Size: - Virtual size: 42.2MB

\TVZ{��� Size: 2KB - Virtual size: 2KB

�Ҿ�*s�[ Size: 47.6MB - Virtual size: 47.6MB

�)�`�IJ� Size: 512B - Virtual size: 480B

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 929B

.rdata Size: 26KB - Virtual size: 25KB

�1F�@@�@
Size: - Virtual size: 2.0MB

R�[�g��+
Size: - Virtual size: 520KB

�j�ȥ$Q!
Size: - Virtual size: 353KB

6@�к��V
Size: - Virtual size: 488B

�M�x�S�r
Size: - Virtual size: 84KB

Ihv��-&�
Size: - Virtual size: 3.7MB

<�g�Äl�
Size: - Virtual size: 42.2MB

\TVZ{��
Size: 2KB - Virtual size: 2KB

�Ҿ�*s�[
Size: 47.6MB - Virtual size: 47.6MB

�)�`�IJ�
Size: 512B - Virtual size: 480B

.text
Size: 1024B - Virtual size: 929B

.rdata
Size: 26KB - Virtual size: 25KB