Static task
static1
Behavioral task
behavioral1
Sample
RamonLoader_v1.7.2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
RamonLoader_v1.7.2.exe
Resource
win10v2004-20230915-en
General
-
Target
RamonLoader_v1.7.2.exe
-
Size
33.3MB
-
MD5
172e0d6ea45bf9f09c6c4be21b3f16b4
-
SHA1
ba90499069739e80a74b56da7bc1e3596ad59693
-
SHA256
88f8be6d4c029d0222055e6cf3a9c35c0ab8be940c502c6ca5ea2e4a24214758
-
SHA512
4d392f9fc791bcbe245d028dc7738f2396b7f3474c1be3a70f0a113386e427df632d354b3119a30e3d47b712ccdc044d1e765c55de82a9b622c45a06f89097ab
-
SSDEEP
393216:qglrz3IAB6rfCweM1K/ypti9KtkO/yTSfQ5yCtETUHPvIipvJB7Uk5lJzlNSP:t36xzystzZlI5yCtMUHPnpV5Tzl+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RamonLoader_v1.7.2.exe
Files
-
RamonLoader_v1.7.2.exe.exe windows:6 windows x64
780165dab2efff5cc85304044cb79e72
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
advapi32
CryptHashData
shell32
ShellExecuteA
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
ws2_32
socket
wininet
InternetReadFile
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertFreeCertificateChain
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EBJ Size: - Virtual size: 20.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.EIu Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}H^ Size: 33.2MB - Virtual size: 33.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ