Static task
static1
Behavioral task
behavioral1
Sample
Loader (2).exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Loader (2).exe
Resource
win10v2004-20240226-en
General
-
Target
Loader (2).exe
-
Size
16.9MB
-
MD5
b530a6917f22c141f3b512da41a8abd4
-
SHA1
d8fda3b0548cd79644a54ce37487bb5de668063a
-
SHA256
7b0cd8227a26986793644de930233445b962c9fdb8eefed0e17345a061dd7f0a
-
SHA512
47b5ad23e653f931810fd72408e008d2bab2fcc19d79f12bc56d9e675d995e5b9312e38608661c1c78fe9314090243491bedebb09179e51ec30882b2442fc930
-
SSDEEP
393216:ljQY7PZgKvGA2uDPAh1snYwV94Vug7JZSfsgK/V:lZ7PZH+AP0s7V94Vug7JZOsj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader (2).exe
Files
-
Loader (2).exe.exe windows:6 windows x64 arch:x64
6bf0c34b99814b39e3c6d715bd581e76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
advapi32
CryptHashData
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertGetCertificateChain
ws2_32
__WSAFDIsSet
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C>| Size: - Virtual size: 10.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.#_} Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KeG Size: 16.9MB - Virtual size: 16.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ