Behavioral task
behavioral1
Sample
IHLoader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
IHLoader.exe
Resource
win10v2004-20231215-en
General
-
Target
0bddce70d4a739784eee1c2d7e08bbca
-
Size
208KB
-
MD5
0bddce70d4a739784eee1c2d7e08bbca
-
SHA1
6b583521d4a93fd1d1c32838cefad8ecf586daa8
-
SHA256
2eb92c4985263be4c2e0c533d44b982ed5a9b6479edc5246b30a561b7854bd4b
-
SHA512
4a79782fb1cb7347d19c6749c087478f93e0742ad96a57c0844233e5f5ddb4f52d00e12e5a4ed406d53c84728fc8bf3d6f5a799eb1046f435c23183f1c26fb11
-
SSDEEP
6144:jSovvfdt+vpdGyJyOGEhB9yZvjAs3tttv:Pvfdt+H+ZvjAs3tttv
Malware Config
Signatures
-
resource yara_rule static1/unpack001/IHLoader.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IHLoader.exe
Files
-
0bddce70d4a739784eee1c2d7e08bbca.zip
-
IHLoader.exe.exe windows:5 windows x86 arch:x86
f5d20c34d3ec8fb8216c432db3cdb297
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
MessageBoxA
gdi32
GetStockObject
advapi32
RegOpenKeyExA
shell32
SHGetFolderPathA
Sections
.text Size: - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ