��4.h<�$���_����JI�۾ἔ�bZ��,g�νBݲԈ�L}�Z�SXĊOW��{~�:��v�- 8@'���MW�{apd����}���ض#o���v\��H�̥�Q@Q�p��~(3Y<��1w{���K���Oܗ�Q,��˭��^8��A&�UoL�|�.+�6��ގ����&���7V�*�؍��Z�@�C;|[9�l�mx"ȭ�,�]E���L�i����8�N8hUn�֕�<(z��h8��ɍ���Ϊ/�.%S����Y}�p K!�Җ����`�qxt�6{Y$w��(�R�]���QR{N:L��&�l���2Z�������Lֿ-��ҽ �_���k��NGGN�_�TD�0:I$���I=2�����j�Z����E� b`�xY$Awc�X��^�^��s�!C��p��D=B�/���L����� ���1��/`�j�ǘ���=)nֺ���m��'���0����K?���a���Olc.�f�d���J�`���>Zyg�V��Ȁ@������N�[�g��m��z�'4�/������Ey4绋�PCJdR!G����b���2�Fn��䢁0Mқ/��b��-=�.��RQ�C����P�N�u�R��Y ?��6���Y��q�[�z���o�"���ί+s��`���$�����\��u�����6F�!�)ѱ���Kp�����=�� i`B��N6��B|y[������$��WQ��#R�QJxU�a�����T����Q��կh}��E3�����G�6��&���-D {����>��n\ ?Y.��?��|:J3!]uٟEH�Z�J�����K`�WI�� >KQ�V�V5�����?!%�3!|7h �ITD��#{��E�6s�7 ѯ�c�;��}n2�Z��u��D�;D3�)����l����}i��@�m�WޯJ@��y�61<+�����������/%mK>s��J�NV�w��w�w��"����J9�׆GP}�CWy��T���iu�� F�*�ؕa`F ��zRV���$4C�g�}E����ӳ����2�1����Jst�&�!�5E�_;H��pB����t�ݟ��nk]H4�2��5��%Ӈ�wc\��]���.H�3�&c_\==������M�#ql���c�S|���Q@ُ�/ZsH|�TVK����58��(�i�Z*\�O58���4��<�Kw�h�^|I� C�H�s�t9�#�M%g���Eɠ��@� _�82w���'�i�[,}JC��Ǔ�L��1xڦX�Fsm����5���qǸ{�+3���=�Ѵ�R����d3���341�ݭ��U ` 6� L�����^�m����NVĭ� �`�g����n6�m��Q�� Oz�r��\I+�E $�=\��|ҏE%+�-�'��X&u�:�`s���l@�JhQA����`M�5q��r-��E�d�p�>?�ɏ8�ά�F|�"Sl�M�����+��v�$�IAe��e��W��}Z'u�bM2hޏ_��=b�QȟTu�ղ�I����E��-�����:�ғ�KdS� ����i�xQ崜�\Y���̰�?;k��寪m�-��|q��/[k��� �� ��/q��e<��]�������L�� c'��d��� &�L�>x ���� �ئFg�@ָ$�~��3(*���Z�(��y��v����*���X�Չ{��#~�����HYe��-E[��\Je�/��Y�U�wľ�z��zf�Ddިs9�������P�ڮ��MV�<��~�W���4��=Q����Ƕ����P�����.-�Ţ��M_=����ݕ=oS�����W�GǦP��~`s��j$ʊ��d`�$hD/r�������E����x"��bIԷ� B\A=8w�Du�\S=�* �e����$�9g�z���ut�l���D`{������7)���F51ζf�U���JR��G�����&�2f�x� �E�K{�y�Zҋ���H�iې�Y�'��3���tq��n�P����L��� \��d�ۉ��:V���&H�d#�ApYyEl�F�?���u �;�Mn.M��DU�N3��o�d�0.&l� #g�?,�|?�kg�|o�w��X��WUi)3����eK����{��M�uvg�Y��o���)�>R#�����{�܂4-�BU"^���x;g�O����dǜ�_5`�����1M�f��`�-�E��A��΅�6����Q�eu �W��#hS�` L>k���� *g�m�G�a,�L�R�����Q��=�|sTrZ+�j�4�HM���sh�}���9Q�26�*��F�w�žp:�<� ��+��;�T�a@��������TV�y��?E��9&����g<��1Ȫ���fMœ�h�%KRN��"�!:n$ �0�� �{?~���e����$�����0���g�~s%�q�z�N�l�䛩��*Xw�+��O�Q�l��m��=<r'�v�>����*MHm��v���ok����$�_5��7��n|~�֞hs�`���^�+�6np�8�d��?���QR'�x1���S�gD!���=��fV��@����Q! ��R��fMp�Q�O�H��R�цǐ�� .�.�d�֨r�8I�H�;J� T��K�����6��l.�]�d.��2M�+�y���Y:��{ }��<L����~Z��˼}t�K�F`2�ߡ�� ��z���H� RY�Oπ���Zh�H�K��9 �k���a���#�ˮ���� w�ށ�E�*�=C�Y�q�==,�|?�Zl��tw�ϰ^�g"��l���~�Ȱ}�z�������?��J�B��}@�Y6�9���*{�y/�`�7&�����l�o�G�n��x�:>k�1�,�֟�@��x2�I�dƷ2]U�*�y����+��K8V�K�pR��9�Y�Z%����6%�vLmhPh�2]A�,�d�F~���GL$�3~��T0��3���Bs�Tv���.���j���;\Oo�+I�Xvi�ǖ��j0��uzTA<�}سJh��3@�����# _T
Static task
static1
Behavioral task
behavioral1
Sample
loader2.exe
Resource
win11-20240221-en
General
-
Target
loader2.exe
-
Size
6.3MB
-
MD5
a12796042f4dbe03a587f063ea60ebd0
-
SHA1
6f469de54263f0ae908f42f1b2169a8f7ddc92cb
-
SHA256
52f11b5e36a8b84f890af11015586026ee64e7f4ccc93ff60adb312647b774ec
-
SHA512
7d476b7c8d82d529523ae144ce79d4cef142ec073893d5414456660c8e309d11b758e7dcc5e8d3fc81c554525f41538f534614ee80706e3b16e78d713b3e759e
-
SSDEEP
196608:dfpaLMJhFEjLa04+SOvFVt805vgI9A+kHCdSr:dfGMJhC204XIp80FBDki
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader2.exe
Files
-
loader2.exe.exe windows:5 windows x64 arch:x64
5bb8b62e000b7422e2aebed349abc8ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
AllocateAndInitializeSid
kernel32
AddVectoredExceptionHandler
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___lc_codepage_func
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wininet
HttpSendRequestA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.huy0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.huy1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE