Static task
static1
General
-
Target
ShiberLoader.exe
-
Size
753KB
-
MD5
55cdaaa2ff57c90724c0bd3b4da846fa
-
SHA1
cef33c7dfbe7f0cad66966d32c930d530d90ab3c
-
SHA256
a9937857813dd62417bc9be1337ccc54f7380cbaf798d60ddf4e2b87097ec021
-
SHA512
bead7b70600cce8c4816c0768c0cacc6351e7662e1a16e53870803f356aaab8f224c1f89964f4e69056bafb0018b66eda07d77d4b16f836c5a4c454bc21ec7ca
-
SSDEEP
12288:s/KdJEWL5O56TGC9/ruFnQ+Faa5YzxpGd5yNLO5gUUPnbefFd1Lbn:sSY6TP9/rAQkI3KENLYUPnO/bn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShiberLoader.exe
Files
-
ShiberLoader.exe.exe windows:6 windows x64 arch:x64
1b59d0c020b545501c689b0f4f87cecb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
send
socket
connect
recv
WSAStartup
freeaddrinfo
getaddrinfo
WSACleanup
closesocket
kernel32
GetEnvironmentStringsW
GetCommandLineW
GetCurrentProcess
GetModuleHandleA
GetCurrentThread
LoadLibraryA
CloseHandle
GetThreadContext
GetProcAddress
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteProcessMemory
RtlAddFunctionTable
Sleep
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetExitCodeProcess
Process32First
GetVolumeInformationA
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CreateThread
Beep
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
VerifyVersionInfoW
QueryPerformanceCounter
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FreeEnvironmentStringsW
FindClose
HeapReAlloc
OutputDebugStringW
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileAttributesExW
CreateProcessW
WaitForSingleObject
HeapFree
HeapAlloc
WriteFile
WriteConsoleW
GetModuleFileNameW
GetFileType
GetStdHandle
ReadFile
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
SetEndOfFile
FindFirstFileExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
user32
MessageBoxA
GetDesktopWindow
GetSystemMetrics
GetWindowRect
SetClipboardData
GetClipboardData
DispatchMessageA
TranslateMessage
PeekMessageA
PostQuitMessage
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
EmptyClipboard
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
UnregisterClassA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
SetFocus
gdi32
GetDeviceCaps
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3d9
Direct3DCreate9
Sections
.text Size: 559KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ