����C� �>n��TR$s��+i15����W��f�֍![��4�Ӧ��T�u���w}o�o��:}Ï ߦ����Yj����EqM��t���Qt{���4 ^n;��$�lbT��$���~Wc�tA��@2��왅�?�J�C���6Ť��W�����ҾCՑ�9N��F\A|ե����x�jg@���R��>��|Gs�D~�H2gu�Y5!�ot�������AF�6SEl�b��77�#$T��S���q9[�Ɂ�|�&�v��̥Rϖ�A���UX!��q����x��am��6 � ڜ�������Ǟ���2��1O�����)���������v����t�&�#4��\�����(�@A���vr�&���9 ;3���.�TF�M7�q����W/ש��f�8I���#C�9��M��b5F�ޮS���u+]�t����s�#���/��n҃ Yw�[�qv� S�֨�砦P|&��gz�õ?���O�ǰ�v ���Ɔ`m�^T��p 2�����"����Ϫ����S�7(������p�^p�ΩL��G�j��4��3�C�R�y0d��fK�9�i���$�v��4�@��cC�B��ً9�+Yc�E�rBu�m��t��s��ΟD�rwږ?i��N��e�R�U ��<aB9��kP�鼸���XZńw3��X�ar�� �g�hu4y�ep[�йprC;}&��Q����nG�{^{��P#��k����d�S�/��:ud��m�L�K�Dg��� Sf$=�t�/6�du�)p��>�0j�ek��u2hf%F��~9d���Up�9�����1�L�զ�:�������U��ܣ�f�'"���&��)�����.Fn�:c/���ىV>#W3��띄����osWZ~��Y�;�� =6 ���<g?K9��)�;�r����*��Y:l�>��I=���/��d��#�*}N����J5��rX;Ay��Yx����R�.>B?u�����}�<�/w����(7.��K]��b=PȲ�ZdN^Q��L4~�=�YK�L��xqF��.�]�B��a/!���Ğܐx 5��u) n:y.l�%rx%6�y,������3�H����"��zHCY]1��^jN>Z� ������ND+�7��^��qhChDφak���-�u��YpZ.��p��LnlhjC%V��Q7��1G��µg%畠}ԋ��F�fȰ�g��~�<ѩߨ��_7�1;� *����L����)�ݘ>���$��X>q�ۘ@�nx ���'��9^��\��g���m�S�I�V[�+��~�)id�j���A�x�b��|<���q �܄i;�w$d�#k�Eߤ&C�m:��=^�n�]���q/[���Eh`�!���r#��C% �q�]x� :�XW�l4�r�*nw�Y00s ��*�C��M���0�|������bz�j�����_�M)��0������M���]�=8�G������JϢn\v#�Ė|�� [��0���j������ P��$/u�0(���\L�8�����ן>> 3�q�`ۂ��`2U�3��2L'��zD�n��m������[��A��R�M���OU8�c'�:���u3Q������#�t�h$읻�q_��cv$P��s�-�����9��6�j �ԛ�'BK���l��X`z��'ڶMM3"Ί��=>oC˽?��<"1$y����_K�@OƴP�_0y�� �B�N$�|+�ޙ�!������s6-��he2� �,��#��������u!W�%C��>��i�� b0g��0P��m�L9�2:� ��x-c:�T�K&�=�2���j��a f.�hM�/ �.��C���0Lb�ҢA��&��=��H�%��=� ����n<�`��wSXO�\{[f�>�nN�+�����5j�A�t�a�Q�� ��U1^�}ulW �Ձ�sդřo Q�i`�0�͍��`��x��A(�˽7.��~-Y�_�=��X<No(h�h�����.����5�@�a� U5ܞO89=���4��}"�5˵������M�`��ٕ�"u��dG���as�)�A1{����2�`��<�����߯�4ݣЬ�A��4���d�B�Dc����rd0���AfG�?ʈ��>����0�����?gz^Y^�Q�{�f}��P-���˳U ��Ͻfp�����1m ��{M��[^-E�m/eb�qhL�73^�E1��a�x g��hPɟ����Z�"�����3(�^v�8��`j�:� L�oUN�B$�8�����ﮁ�u,Q�����N�M�i�Hi~����{��{4Dɲ|oL�p%�tZ&�~�)HiKo���|���������� ���� bw�o��l�(sGcވ��(��;cR�I B��=L��Z>�b�ɘ�f[@ ���rϵ'��ʾ짻�T�����NF��#�E�87h�u�� ��_z�+8�KŒ[~'��47�tǞ��ͷ���-m�?���'���:��'�+G��'��݂C{���5Ax���8iO�ᤔϢ�(M���,+(��-e� U �v�3 8���e#a�xqq�2X�j)��mK��6����^qR(g����Y���̦��9����9�ʷ����C��y��u�`K�W�L�(���^i���ߏ e�Y��J�Ll�x���r����RڈiM�w7ux�k��R��l��sM�1`eQ"-��]e3�D@���������Ì��n���AՌ*�j5�3~�r~jA��\K"� >?/V� f&�Q,��k�KɅ�/�{���o��=_ҥY��vlm��{(^/%�Q~�������� ��n?��`�l���f*p�5��������T�?��7+�}��Ə�s��`�ͧ����g�߈+ �?E�+�}��: V/��JAʬt��8BB�yK��*��oA����5��[4E,(c��'�4�s�zS�gzs_��ŧUO�vt�Ш������?�u���\��'�L�n�u4�ɑU�_�p������Heճ��
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20231215-en
General
-
Target
loader.exe
-
Size
13.7MB
-
MD5
65304b56d241a85694695056aa74b039
-
SHA1
598c5a784d66ff30f52aef527e6fbfe4313d1337
-
SHA256
f0603f10daf8670fab9b01a191f24d82adc876c02b44629f21ba39a9de5b60b0
-
SHA512
bead000552a6410a8f2a762f2f84a41dec20303306bb41384d4195d70ed76016fc6ced29f06bdeaedcd030322e68ec2f4308977bd5632539d028058c67ec7386
-
SSDEEP
196608:MOaNBUe1BW5xBnZbGGsqvDfeOdwBL8+/gcnEogoCnAjO5/Z3i2ZPjhBFrzOMu0tc:4se1BW5xZZ4elwBL8YN1jytvLuTa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
f794da88cf2911ea90dc52c50825b7f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
gdi32
CreateRoundRectRgn
msvcp140
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
user32
SetCursorPos
CharUpperBuffW
kernel32
OutputDebugStringW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmSetCompositionWindow
advapi32
CryptImportKey
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertEnumCertificatesInStore
ws2_32
gethostname
shell32
ShellExecuteA
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gtN Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bAn Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?80 Size: 13.7MB - Virtual size: 13.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ