Static task
static1
Behavioral task
behavioral1
Sample
loader_prod.exe
Resource
win7-20240220-de
Behavioral task
behavioral2
Sample
loader_prod.exe
Resource
win10v2004-20240226-de
General
-
Target
password_is_eulen.rar
-
Size
23.2MB
-
MD5
795f194fe5f0038dd9794a7b9058e14b
-
SHA1
3f090fef1ca9856fbee684a33a5c6f23d912b134
-
SHA256
19cf148b5170dfd37c491e4c6ca9ff4c714f45110e8e604912c8bc7ea262dfe2
-
SHA512
cb14beccc8d3114f2fa7a8d2092322ed4a99849b093a25ffdedd5469ad46707ce6a31ec8bf546b9f271ec852b09285417ca1153bc587eddfab2adb5d27f365ba
-
SSDEEP
393216:hl+iH3nxsi0JifpZ1CyApeBJ4ZT6RCQw0qnAT+1Dfi2lmYkBusHwFrNhQgRc:hl+Y3QohbCyApOGRWAATYTig4osQz5Rc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader_prod.exe
Files
-
password_is_eulen.rar.rar
Password: eulen
-
loader_prod.exe.exe windows:6 windows x64 arch:x64
Password: eulen
2ad5bba9a7f55df153e18e95c7aa0b7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetComputerNameA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetActiveWindow
gdi32
DeleteDC
advapi32
OpenProcessToken
shell32
SHGetKnownFolderPath
ole32
CoCreateGuid
oleaut32
VariantClear
ntdll
NtClose
msvcp140
??1_Lockit@std@@QEAA@XZ
shlwapi
PathFindExtensionW
ws2_32
WSAGetLastError
crypt32
CertOpenStore
secur32
InitSecurityInterfaceW
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
gdiplus
GdipSaveImageToFile
dnsapi
DnsNameCompare_W
rpcrt4
UuidToStringW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
_itow_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ldexp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
🧠McC> Size: - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠=sSv Size: - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
🧠:v:. Size: - Virtual size: 789KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
🧠#=9K Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
🧠QGxF Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
🧠Kpw/ Size: - Virtual size: 18.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠P5Rr Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
🧠zIDm Size: 26.4MB - Virtual size: 26.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
🧠@z@j Size: 1024B - Virtual size: 737B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ