Static task
static1
General
-
Target
exloader.exe
-
Size
300KB
-
MD5
e7c70dc57c010331d84a1d5488a350d3
-
SHA1
be7de41a0ef5b9d26bb6c2ce8e245bc38cf840ec
-
SHA256
1c94328ffa566dfb98455e8eefe67e9410cb446e41b73a195e608a0eb9467db7
-
SHA512
eaa1cfe9af55644532dc5b1869738ca90352ae57969c0f8eab4c765b5bbbf61f18b52957afc38d6874b7a9fb8e8cd69ecdf9961f7d85779d337faa5909611d0a
-
SSDEEP
6144:SNMg0Q4/yQPaLSF1kxdLbskoP+v9Gu/wtPNkfTLIoJ4fSOgR+pWYGZ8YXU:aK6QPaGDkxdLbskoGv9Gu/ANkXIGuS1i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource exloader.exe
Files
-
exloader.exe.exe windows:6 windows x64 arch:x64
7b893a6fcfb85225cdd3cc59f74b1cee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmSetWindowAttribute
flutter_windows
FlutterDesktopMessengerUnlock
FlutterDesktopMessengerLock
FlutterDesktopMessengerIsAvailable
FlutterDesktopViewGetHWND
FlutterDesktopResyncOutputStreams
FlutterDesktopMessengerRelease
FlutterDesktopMessengerAddRef
FlutterDesktopMessengerSetCallback
FlutterDesktopMessengerSendResponse
FlutterDesktopMessengerSendWithReply
FlutterDesktopMessengerSend
FlutterDesktopViewControllerHandleTopLevelWindowProc
FlutterDesktopViewControllerForceRedraw
FlutterDesktopViewControllerGetView
FlutterDesktopViewControllerDestroy
FlutterDesktopViewControllerCreate
FlutterDesktopEngineSetNextFrameCallback
FlutterDesktopEngineGetMessenger
FlutterDesktopEngineGetPluginRegistrar
FlutterDesktopEngineReloadSystemFonts
FlutterDesktopEngineDestroy
FlutterDesktopEngineCreate
FlutterDesktopGetDpiForMonitor
kernel32
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
GetSystemTimeAsFileTime
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetLastError
RaiseException
RtlLookupFunctionEntry
LoadLibraryA
GetModuleHandleW
FreeLibrary
AllocConsole
WideCharToMultiByte
LocalFree
WaitForSingleObject
GetCurrentDirectoryW
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
SetDllDirectoryW
AttachConsole
GetCommandLineW
InitializeSListHead
user32
TranslateMessage
GetMessageW
DispatchMessageW
GetMonitorInfoW
MonitorFromPoint
LoadIconW
LoadCursorW
SetParent
SetWindowLongPtrW
GetWindowLongPtrW
GetWindowRect
GetClientRect
SetForegroundWindow
GetSystemMetrics
SetFocus
IsIconic
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
PostQuitMessage
PostMessageW
DefWindowProcW
shell32
CommandLineToArgvW
ole32
CoUninitialize
CoInitializeEx
advapi32
RegGetValueW
msvcp140
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sync_with_stdio@ios_base@std@@SA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Xbad_function_call@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Thrd_detach
_Query_perf_frequency
_Query_perf_counter
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
vcruntime140
__std_exception_copy
__std_exception_destroy
__C_specific_handler
__current_exception
__std_type_info_compare
memset
memmove
memcpy
memcmp
__current_exception_context
__std_terminate
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_errno
_invoke_watson
_register_thread_local_exe_atexit_callback
abort
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
_exit
exit
_beginthreadex
_initialize_wide_environment
_configure_wide_argv
_initterm
_set_app_type
_c_exit
_seh_filter_exe
_initterm_e
terminate
_cexit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-convert-l1-1-0
strtoll
atof
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_dup2
_fileno
freopen_s
__acrt_iob_func
_set_fmode
__stdio_common_vsprintf
__p__commode
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ