Resubmissions
12-10-2023 04:58
231012-fmadpsge4w 5Static task
static1
General
-
Target
Loader.exe
-
Size
6.7MB
-
MD5
30f085bc02e0f3d3962e778c126d3741
-
SHA1
5866325bb118257b4d2fe1f1763806ec1b55b052
-
SHA256
832f0e0bfbee83129167535bef4de0fcf1c6973868be611d9a9e3843c2073a9e
-
SHA512
88d5c08e3dd385a20ec38c25610eaf1f4cdde5336f796fe0f3c4d6c301c6652210a3c27632e24e92d5f0b8acfc81b91ba21fdd761e3fc2331e439d93839e0f43
-
SSDEEP
98304:eCmGTzpfWVykI5gHxXHat5eEka5TCcFTjcTEQtGx7AqSdWSX+6:eCmGTVuVjnZaveEka53jX9AhoI+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
68357c739eedda1d4eeb09913f1c13ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ResumeThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetLayeredWindowAttributes
gdi32
DeleteObject
advapi32
GetUserNameW
shell32
SHGetKnownFolderPath
ole32
CoCreateGuid
oleaut32
VariantClear
ntdll
NtResumeThread
msvcp140
??0_Lockit@std@@QEAA@H@Z
shlwapi
PathFindExtensionW
imm32
ImmGetContext
ws2_32
closesocket
crypt32
CertAddCertificateContextToStore
secur32
InitSecurityInterfaceW
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
gdiplus
GdipSaveImageToFile
dnsapi
DnsNameCompare_W
rpcrt4
UuidCreate
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
🧠RYIK Size: - Virtual size: 989KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠u4@o Size: - Virtual size: 521KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
🧠p`vU Size: - Virtual size: 787KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
🧠s4qg Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
🧠>W.e Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠oUkL Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
🧠MB,l Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠5"BL Size: 1024B - Virtual size: 737B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ