Overview
overview
6Static
static
3Loader/Def...ol.url
windows7-x64
1Loader/Def...ol.url
windows10-2004-x64
1Loader/G&4...Hn.exe
windows7-x64
6Loader/G&4...Hn.exe
windows10-2004-x64
6Loader/Req...me.url
windows7-x64
1Loader/Req...me.url
windows10-2004-x64
1Loader/Req...ne.url
windows7-x64
1Loader/Req...ne.url
windows10-2004-x64
1Loader/Win...er.url
windows7-x64
1Loader/Win...er.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Loader/Defender Control/Defender Control.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Loader/Defender Control/Defender Control.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Loader/G&4l2}&Tx'2YwpS9FanY~SaPDi,[-N3UQrX!yhl}d_Hn.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Loader/G&4l2}&Tx'2YwpS9FanY~SaPDi,[-N3UQrX!yhl}d_Hn.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Loader/Requirements/DirectX End-User Runtime.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Loader/Requirements/DirectX End-User Runtime.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Loader/Requirements/Visual C++ Redistributable Runtimes All-in-One.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Loader/Requirements/Visual C++ Redistributable Runtimes All-in-One.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Loader/Windows Update Blocker/Windows Update Blocker.url
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Loader/Windows Update Blocker/Windows Update Blocker.url
Resource
win10v2004-20240226-en
General
-
Target
192a6216c0aaa2a563ea3c5cca40890aaa29a4e08996cde4ce7a786a409de28a
-
Size
31.3MB
-
MD5
531d05c43ed4a8dbc9a7980f394a0d92
-
SHA1
daff7b9e785b44afc4682c228579cf2522ec6e3a
-
SHA256
192a6216c0aaa2a563ea3c5cca40890aaa29a4e08996cde4ce7a786a409de28a
-
SHA512
90248d18f36f46c6c31d5d26a80361c6c8abfd53e114ca1f3874b03254a8653d28b535f3df9c795ae20c7f247a35c15cc5922a3ac334c3f0b5757636306cf3f4
-
SSDEEP
786432:HZFI8UBx34cjpBeyc9r0PvWrM5A4SpbzmMrg5+pjr:7dUBx4cjpBvcR0GVj6og5+p3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader/G&4l2}&Tx'2YwpS9FanY~SaPDi,[-N3UQrX!yhl}d_Hn.exe
Files
-
192a6216c0aaa2a563ea3c5cca40890aaa29a4e08996cde4ce7a786a409de28a.rar
-
Loader/Defender Control/Defender Control.url.url
-
Loader/G&4l2}&Tx'2YwpS9FanY~SaPDi,[-N3UQrX!yhl}d_Hn.exe.exe windows:6 windows x64 arch:x64
874da9d42fd7eafea71b16e806bc032f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetCursor
advapi32
GetUserNameA
shell32
ShellExecuteW
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmReleaseContext
d3d9
Direct3DCreate9Ex
wininet
InternetOpenUrlA
crypt32
CertFreeCertificateChainEngine
normaliz
IdnToAscii
wldap32
ord143
ws2_32
closesocket
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.decrypt Size: - Virtual size: 21.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.decrypt Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.decrypt Size: 37.5MB - Virtual size: 37.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Loader/Requirements/DirectX End-User Runtime.url.url
-
Loader/Requirements/Visual C++ Redistributable Runtimes All-in-One.url.url
-
Loader/Windows Update Blocker/Windows Update Blocker.url.url