=�=�~Q�}�1�j��c�AG���C��� ����e0=�)���K:�o�h��͉8bֽ�M��I��|QؾA���l|�v'���zsZ�$�|!d�:���P/��X�n�֞��3��eq���,XG��c�JR-fL��`��8�M.����s�Az���ܧ<ZTԇ��pߛ���.�X4h����ч=����x�G�/B�[5�������VV�E���<��:����s�"'>bQ"C�`�8Եs���c2<�Bp�����c����F���,�8R�#a"%-�2��-��,��v9���!��2��9//�l�����a�xd�mX��x�K�ẅ��3h1/�����#y6j����t#a|@/z��u��EKƿ�ׂ8{/h(`ޣ�:��~��ۗ� �8��K�9�Z7��ޯJw�h4���u�硍p0�4���}�}�0��ch�m��"���w���|*I���Lg+Y��d��J�N�ƹZ����j�<sI����p^�{j��IXX��>솲��g�i�*��5,�#���B/��K�a�4d-����&"4f��A������j��(I�<k��i(��I2.zû��8����KIA���l�-���Č!Ӑ#�j� -#}{�Jۯq(�@8���U��g.Z.[����z$��8}c}J�jI�:�yvnzKd�[�*nN���]n��~U�3�9��f�] H���3@�T��������7{J;\��8�t�%d����\İ$h`Y*��b�j r!� ��ӷbԲ�8�-���� ǐ�$���!cs}6N��.]���ںt���OV�Zk)�W�Ƚ�=�xr�-(���vYj|�͛2���(NX�2.����4��c���¯�\��XU��I�����s~Lb��?������}(J$�s=�s���v��4�����RWX��*�)���R�4��%@8�S�M����9� ���P/!�x%*�E�$�������$�[1��#� _�Zqjw�+�(��q� ����P$'h.[/�5�)G��ﱗh����Rӆ���Pth��m��屮m?B�ȶ��=��l��������L�٤�Z�Y��� �w$C[��T�I��].{ch��W�S,�ӄd�ǡ 5�����L*���W�*��[��V�J��� ����Fm�8�3`S(`���k�k_l���M���_���gƑ�[\�.��ƍ7�����tk�27E�qWI�n<�\e�?{8�Ʀ��aJ����<?-@���M�]eT������{-�?�萉�Rל�E�2�VQ�C������v@K�ϬR�FFB�4lБ�ʴ�7�����o��\����{Ű:2�W���<*d�����!N֘<�K,SK�iW�*m�dP_K���w6�q(>q��-���d+vX�$�8C�s��xs����ʮwB���siQ��F�O<� ��TΧ����B��l�s�������\��pc���7���"fr37r"��&�xv��Uf����y=���!�x ~-2��ڴ�M��p�'���<�s����c+ஏX�i�Dfo��D��_�`�-ų�t'�1�t�dz����[Li.m��PIDQ|C|a fg� �������G5�80iZ��p g߆alz�Po_}����l�i�?������9�ʔ�� fHzl �m�ƈ A�~Ӝ���F��w r�B��eqf��}��Ζ{��Z������2�`�m���A�k]�@�л�:�\X�A�_+�wwע��o5��s��Ah1a���U9rs�]{ @�����#1H�7t�p��QΑ���&��������w(�G\n�2p��'�� 8���<�@�����}��E�T�%�S��²�}͵A茯���rn�t+��5A�A�����җi�>xA)rhW�SXf}���B�f��`���+!_~��� �R����]��.IM�4����߰�!h��ӏ�Wq[���D��L. �9�`0\�^�+'n5jtzw@bog�e:�g�N�kXN�^u�5�"@�Q ��a�=�j��(n�Y�)�i/�B�"���B�Z��P�Z1�c� �2�>zl��e����>Nj����0���_@��H�u5��u=�g��E���)�wՔ�I�ϐ̼S�68��o���+�*�)���s��`"�h����$�d�4m\��2�:<2�"~/���W\�I������h摗ȧ������d3^] �?�T��+���m*I�w�Bа���'��~�$�Gt跎���_��mJ���zT��4.��)��B�: O�"#Y;Za{2<�� E�h��є���Q�-�ۄ����c,�a��ѷ�j���Ub�c��Y1B>���X������m�������,/-!)4ɉ�.�+��D��f��P�`���ؓ�ɜ��Ɇ���Y���3��K3�}��y`�����c%�;����ת����yv}�/��-���<��t������U�k�����0:��w^p~�&�L�t(mʶ~�c���+�Y,GǍ� Q7�(������HPN띐�p g=#�|��u$3�JB�5�,E��;%���Y���/�F�,�l�����aI�Z����率(O�*��#5���NS0�Z��e�߲w�$z}i-���pWC:`o����=o��n�t���)�Ԧ%�t��%�Xk#C���εx��~r�4����K^>+湱�Zk+ �t��ۜ�t+��q����^���ymԏ��_=,hb2��$;[5Z���C���X�X�����>&�j�]���)����=q"о&*H��eA�Qq���\]TG��)�_U�_�z̘����ĕ�>\>ݝ;^m��^ �W�6%b�F�Fv;[%�����>�x�&n^�M�cч�Kz���d?Zq<���K���[��w��qx�ٳ�a-u �L9c�|�����?�:�*�~|/*۔�zp=H\�a)������D��#G1���u�שh�e�����~��z[y}�Y�4��00���� �CN"�[<����gzp����R$~q�=[1pihvZ>��M�����8�Ѵ@��kOI�>f�z_�k�R�Ĉk��Yz�*c����Ȑ �j�.�b>ICrӖ�t�1s":.�|W�(m'�d$��\��g��ѻ�"g}��6�2��B�M������_X���gi��)�84��d��r�`�26��oAe�I�G���i-���uaҬ������D)����ɏԍ0`N�G�(��-66��(o�Ƭ���/�!�#y⼒�,|c
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20231222-en
General
-
Target
loader.exe
-
Size
9.6MB
-
MD5
1b3bdf831ad6db70da6f161b6b64aa63
-
SHA1
7de5472aecc1b1a279dcd7e4b2b4e389fdcb3ce9
-
SHA256
62f240031f139c3f94bd4ad49ab605e8acc18bc20551c1bbe74e571f4a9c3025
-
SHA512
1142b477a0910d2c6a04c3c088366b38cdfc04c558aaed854af89857662c24ef635d170e024d7c575aea3da65ccc60b38df287f428b59095282a66a41bf6649b
-
SSDEEP
196608:iR12C4M+HYdO5gZZR03/uXj8OEaCmKYw4boUsUK1fcFVtzDb4:iRACEHYd4UU3qAOmmKY7cUsUKe934
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 358KB - Virtual size: 708KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 631KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 38.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE