Static task
static1
Behavioral task
behavioral1
Sample
FSL.CC_LOADER.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
FSL.CC_LOADER.exe
Resource
win10v2004-20230915-en
General
-
Target
FSL.CC_LOADER.exe
-
Size
613KB
-
MD5
eadc5bda6635074ff26f11963d3e88d6
-
SHA1
df7b6b70f42834b3e7e36d0434b7b071157f34b5
-
SHA256
f743794c2772c63b1732c923e88b6d284e86dc7b0f7ca41f6ce31a747ba75135
-
SHA512
6d49bb27b60fd2fad9f133da4b1430b018d535d698f4b40350501de8187eede2c029c5ced65018fc4f4bddc83bbd57877cfe8b343562f1d302d5506919f706c9
-
SSDEEP
12288:tEBRKDs3QD6Eec6UdLA5y/Wbgf9QIfYc1YLO:tEBRqx6fc6GLPWb4mIfH8O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FSL.CC_LOADER.exe
Files
-
FSL.CC_LOADER.exe.exe windows:6 windows x64
43dbf08e58b4070277aebc7a52d63907
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
Process32Next
GetProcAddress
GetExitCodeProcess
GetConsoleWindow
GetProcessHeap
DeleteCriticalSection
Beep
HeapDestroy
HeapAlloc
HeapReAlloc
Sleep
HeapSize
GetModuleHandleA
WaitForSingleObject
CreateFileW
CreateThread
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
FormatMessageA
LocalFree
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
WaitForSingleObjectEx
MultiByteToWideChar
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
WideCharToMultiByte
InitializeCriticalSectionEx
LeaveCriticalSection
GetStdHandle
EnterCriticalSection
SetConsoleTextAttribute
HeapFree
GetConsoleScreenBufferInfo
VirtualProtect
CloseHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
ReadFile
GetLastError
CreateToolhelp32Snapshot
GetCurrentProcess
SetLastError
user32
ShowWindow
GetAsyncKeyState
MessageBoxA
FindWindowW
FindWindowA
shell32
ShellExecuteA
ShellExecuteExA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
psapi
GetModuleInformation
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord60
ord143
ord217
ord46
ord211
ord301
ord200
ord30
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
crypt32
CertGetNameStringA
CryptQueryObject
CertFindExtension
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertCreateCertificateChainEngine
ws2_32
ntohl
gethostname
htonl
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
memcpy
memmove
memset
memchr
strrchr
strstr
__std_exception_destroy
__current_exception_context
_CxxThrowException
strchr
__C_specific_handler
__std_exception_copy
__std_terminate
__current_exception
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
calloc
_callnewh
_set_new_mode
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
_strdup
strpbrk
isupper
strcmp
strcspn
strspn
tolower
api-ms-win-crt-stdio-l1-1-0
fputs
__stdio_common_vsscanf
feof
__stdio_common_vfprintf
fflush
fgetc
__acrt_iob_func
fopen
_open
_close
_popen
_pclose
fgets
fputc
_write
_lseeki64
_read
ftell
fclose
__p__commode
fwrite
__stdio_common_vsprintf
_get_stream_buffer_pointers
_set_fmode
_fseeki64
fread
fsetpos
ungetc
fseek
fgetpos
setvbuf
api-ms-win-crt-runtime-l1-1-0
__p___argv
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_initterm_e
_c_exit
__p___argc
_initterm
_crt_atexit
abort
exit
_getpid
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_register_onexit_function
_beginthreadex
strerror
_initialize_onexit_table
__sys_nerr
_invalid_parameter_noinfo
_exit
_initialize_narrow_environment
_errno
_cexit
_configure_narrow_argv
terminate
system
_resetstkoflw
api-ms-win-crt-filesystem-l1-1-0
_access
remove
_fstat64
_lock_file
_stat64
_unlock_file
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-convert-l1-1-0
strtod
strtoul
atoi
strtoll
strtol
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
advapi32
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
GetUserNameA
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
Sections
.text Size: 479KB - Virtual size: 479KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ