��F��9���ѐF��ތ���x��oOs�\���y@|$Y-����BA���>ت*m�l��(���aٳ|��Ȝ��ܨ.A)���E�^�7�-uL��T�E���M�Q��Eb���% �)w�e+�e�����Y�e%�� ؔ�`�R8\n:����-�@'K:��<�N�5���k�Y�xШʽ�xF;�u�m��FC��k`x�X��Y��i�,��Ke�lF��>vn#����AJ���&+��ۥJ��Q�l�^&Bv�u�,}���f+T�K�jz�:9x�/���-��w`��C�0ʴ2&�S��Y���������1]�,����ũv����c���z"�ʅ��nx@��ךk�w��x�����]���|���7��dܑ�/�ᒳ���˫EB<���z]��2���"��ˁ���*q�A�W� }_]w�>͐�����X��ά�ZV��H s3q��_�����������p����tގ�n_��g�����w�+jb~ӵ�:�eq�}��ΠP�����3�Ell�U����դ���|d����%_��"���}~�Ʋ�^�X�qo*����x�������%ݲ�JCÝ�ޞ@B5��I�U�pw�U|��^rPds�ߜA�$\�B������#��F��B�d�v����d�����BW�,��5��5����mj�����������k�JƦS�D�f_��x�T!w���"��C�d ���N���s���d_ 9R�6�g��5?Aq4F+��^�nw���H��rp�ܷ�?�4U����D�+�i�0dG�,i�;�J� )�5n�~�n0>τ �F[L�"��O���;���t�m�5J+�fs����w�%��D�����-��ckLB$��kEc��]�"!�= VY�t������)���x���c�JÁ��i����&}�w�s�N�r���;��k�'�m���\�����N�]�L=-��>����H�=�0^gy�#�%���8ș����U����1=r�쟰�������{���h���8�}�� <�X�^Ij���y�o��Q��m�|�?�N�|m��=4����k�0�6���袜��{�% �VS%���P&�҂��C��u{�{})�l�� au����c�a8����?I#8�C:�#��N-s��^S5+�� �M �e ���*N��{���}:YC�y��}�D��)~�w=��DGOy��/bVO.=�����p_��JK�5T�9K:�����XA�9�u�?�2�I��mʹ9Q�L��^MCۏ���V,��<Q��<�i.�$�0���`�I2�#�^��{�Ea6���Q5���%M����p�~=O�������o�\���� ����x����9�.P����;�����bE �OJQ�L��h����I@��W(h��3�'�ʿ�t,$��dG��F6P-�6�!7q�o�I�7��{[��.���b��pO`�V7�{L��� hCɖPĶ�i6ki #�M�ƃb��95��R��RZ4�:��I�Bī�ü��-���� s��ߔ�~Z(x�yi.t���S��z�u�.+!D�h�x`�������Ňh�C����aK���Gʣ|��d�Kk�z|�xq�P�r���^B0!Y�K�p��4���[��Y)-<��;R�$��LZ��gB��U�2�#hUb�;�o�4���V�$a���y�P���X�Z7�rP�$��)��M�q���������CT�O�Sp���z�9zY����.�j�U4\�k=��SZ�D��� �L��?,\�#��i{V�d㹩i�J�c��O 9���9�NqCw����MG���M^�̕�z��&y�ߋ���d� � 3M��r,}��3�锐�7�[U�k�l2v��n�|�Ů����<EL�1i2�wݍ ��Կx�G3&������� ��{�Z�k+in)=�2�x)W��%�����<���"�d\V����e�⍧;��R�D��=i�hL�6~�y4����P���"�sz���V��3.�9#kne㛑h�6�ã��q!pג���ȣ�p"a*$�k~��y��g�1�$(�G�5��%e��K�;X�U��b�C�C]�� �z���"Fbj�F�����7���\�� �r��Q���.�p�(��(��I�%�ӀlZ��'�.xȉ0Ds`�j�{!X�N���HcU8Gp7F,����j��- �Tk���������0�U>��},DN�J��*� ̘%7t2�E@���m"J|)=Hڭ\�,K����j��Bj���)2�\5g�N�PI����+JQ���jM�a� �=��I|�����@��~a ��^в�Y�w�n-��W��+1YsU�;��f(�3D�rV*}��P �ޢ[c/n��5~A�eAV�P&���{��U�=RY=�Qu���feӆ������X&���.����n��ޗOwqG��2}�Y��5:r����G�~�v�Dq׀A���Y����Sv���>�]���K>�� 渼�.�|\uh���������T]ǁ���y��:���/E�/��%�ۇ�F"�� h�]Ю�I����R>����eJ}m(��;�v���(u�N�̬�͊�`�F�UC���C��<T��H������h=ۚ����8��٬zA�Iv�ϭ=e�Q����!0���%�'E��M����ͧ�H�'d���5:'6[�$���#*I t�Ss����'7^E��d�Q���'��V�>;1�W��*E�*�4�����ʬeM;0���8�|��<?�Ds��>���N;ap���@��jr8��W�(i����)�ם�3�1�=e� ݀�:^8��5Kz�_����iy�s �hl������>eBV|��%Q\kZ�������&;=����B�m=��1���O��]:S��M�u4�v�����@т7����kf5��g�����Rk,5�&e(.�'R�f�C�G���t���A/όk>5�C�`�-��(��"6�H��Mm����X�}7J�*],�5�@�(���b
Static task
static1
Behavioral task
behavioral1
Sample
DLoader12_2.exe
Resource
win10-20240221-en
General
-
Target
DLoader12_2.exe
-
Size
31.1MB
-
MD5
68903d3f68c597b81bec3aac7e5262b6
-
SHA1
1f93c60132d8214cc607b31685ff0d4584945c6d
-
SHA256
e7c66fcd925b69cb122c1fe2c016427f6fd274db70cb3fdc17402f1a37e91bc7
-
SHA512
3734ff020ec1b94dbe0a9535166bfa9714e80e84195af60c7221bd1779956c63cad41831aee10bf52226f59ed81fbe3a22d6ae78114aa9e05fe88f0009fc1eb5
-
SSDEEP
786432:khEgtzbETxc4nZMQgO4SPVDMlUUs6tFBG7r0mCFccM:0Egt0xcWic4SPGlU4rEY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DLoader12_2.exe
Files
-
DLoader12_2.exe.exe windows:6 windows x64 arch:x64
b4ed7b7918c77a929b9cdd9dbadb629e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
RtlCaptureContext
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassW
CharUpperBuffW
advapi32
CryptReleaseContext
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
imm32
ImmSetCompositionWindow
ws2_32
WSAGetLastError
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertGetCertificateChain
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.B9s Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.(6_ Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,\a Size: 31.1MB - Virtual size: 31.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ