<C�|_�r↓�����`������Ø\�NaL����'B���:�DzC�s�<o/�%��l%���a��c� p�{!�R^�W8�y9Q\kh��DU�� ���3s|ɾ�>�����Bu��HdW�����pt��fʃ3'P߁�P��B,p�vl�?���F�eЃ'ouח'1-`�Dz��0<��Y/��e ���Jmh�̻���֗���JyZ'���&��WJ�h�J*3��C� ձR��'�� ����B#�Bf�:n�Q ሄdw������zڳBhV5�k�~O�]����q� ad'���ʙ�Dlej�|��������>V8�����w��]H#�"��{�T���~iP�X��C�w������a��XǦ�(/F�1�0o��\�0t��q[�"p�ڠ�τ����V �!��&�M����f6�W_Ye�u������&��|�C�i�m%���;�H:h�Zg���74xx�D����={�R���jW� ��s+L�^����6_.�+JZ��H|����=�<g���_��|}D����Wܝn{�h?�Ԉ2..�� l��T�P��T��D|l���i��.���Kqc6����;э��R $��o^R4RSR�� �Li��M���k����x��}���Y��k21']���O6�-�u&����Q����Yu��ȴ�]�����y��ɤ9��Ņ@���#�+�:��E��C���6Q�r�7}<���� ��û ^����ꦪ��::E�FAe-�����ۃ�w n�7tt/5����[эN���)� O��ĺq���zŮ����Cl6N� �|GB��G�K�G�Պ������v�q���{��!M�Րj����IW&�W�J=��_���^°���g9���MxVo��HE��c����`���D/�,�~V_C�0߁�i�J��i<X�^���"R�w����o�Y��:c]��W=e�~s�vH�H+�@���o�n��t������oo��En��y�����R~�(��4��{I�u�-��aQ8��d"H������CuRu�N�A�G�u�s������S�1�5�S�ݦG�Jd�!�?ALݞ��օ��~)�r��߱�]����7��Jy���E����p��8z1��y(kAi�.Ki�}��;����S�|��H�9�g�S��*�������P����w�Q�����x�����7��Z�V,ջoCc����p��<P�l�E5'C��1��+��zY�5����$��[� wh���;w�y]h��RӐh���)�J� ��C�W�݈��1�ѬG������l�g����_-kD -�� �Wm���LxzS���Αo����/j�8-Mo|P�~��:a)�I�^ҥB�99�ejR��`5>�<�)� @�~0�%�˫�&9�X>�,��b6�\� ON��P�}�(�P,����ё�WƸ� A�m,!��J�E+^aU������M#d��3�;hVЩ{����Ĕ9��A��kt�?���:��v�g�"hΞ�QP�2�|� ��//��,��2 7!��Be�����,��P97}=�Jx4�A��yDo��t>��o<���� �zxߐ�}�h�j�@�e�F�Ѻ^t6"��DiT��yD�в20�V'`�g���W�:�Xvr�_N��~������VGG܃���<�6Є���N���I�O�Ǵv��r���t���]�x��R�C�y��-���aV����2�A��N�$_sVI���bxO������S�7�p6|����NJ�}(}+rj&'m����>ݯQ�C��MZH��D)���AZo�W9��i]�f�@0�8L�*� [s#�#/��h���f^ ���:p|��z�:������7h'���=��x���Ll��f�����ų��0��~J�����Z�r�QTt�T�73e�$��� K�쭒} _OL!�}���ų��%ғ��� ��Ȝ �oB�a��^� ���q��u�]#��Z��������_���7l�Օ�%�hؘSc��9�y�ۊ;P���Z���hclb��L��]1��n=���Y7/`�1 ������#U�iA��������q����E��F��Ѩ3N�HH%���[��R����uvh"ǯ�+}QSv�/���T�17���/(���N^���u��s�K�����h�w�Z�O��j��Pe��:9� Bu����|�Ϧ2�G=��jr�rբn� �,@� �r�p�� U�5�<$�v����X��q�o<}zߕ��*��W��}-��Xu/}E�W$��`q��{(�ߟ;�r���P;Yk{�[��YRw�e��'��g�z "���;!���o�t�+4�ӛ�J�e����S��qDT3�^�J?�ao[�*��W+6�x���kQ���JU��CȢ�~�Ņ��*d�r�UY�v!L�s�Hg�y�uu!ӝ\N*�}[��HPCP���:�f<��?kA{sK�A�af��$g`b�;��Z��e4W=i�(����f݆͡���eB������ZJ��a���g���+U��V��+�G��Y�@�*���" ����& �F�ʍ}"��^m�zS�ט���tեe�oO'R7S}���M�M,L�_`�a7L�O��r�6��a������SE9���7�!m��W��{VtX�H ,�wƿ;~��U�?�z@�C>M1m�x��W�Z�����kOzў�D�,�g�g�V%�U��y�DT�ai�M%b���{97����1�{��]�cN��DUŞ���Y�̾6���"��8�?��ށ[M��<wp?�`�_߷s�rl�a���b� ��2�,]�Nܭ���(�%CH<:��y8[6j���;��.Ƈ�I�vw�g�Q��Ԍ�c�0��HM�&��A g�0�e��k�w-�ꎋMW|z�?��P���D��]p�������bh�A���7�wQ�@��W�7uv�f�˫^K8���%����ź_9n���*��X��S��������BV��P�.�6�C�[]�)uF�v��X+��c���d�����+�,
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20240419-en
General
-
Target
Loader.exe
-
Size
7.0MB
-
MD5
a011ed7348c44a3c45d588a26b602223
-
SHA1
af5caaa2d4a8cecefd72ef2adb99856892457e51
-
SHA256
9c15f2cbff2331e3092eaa2625e9d7f3fa8d120badfa5bfc8d4b597d718ca9ab
-
SHA512
8e8a55aa5ec08235ac940c0261bf8fc87b9dbd970b3ca6267e082aabc4ceef7ec818d434afba63386765c3576ed15ecd2320bd66881aa2312235d357718c43e7
-
SSDEEP
196608:sIko3gPJK3S4fwGtIMDkGFT9tl+2Uzp47bhi:sS+K3S4fYyJ9rvsOhi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
a41d235536266cba0f5132017327cbdd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
CharUpperBuffW
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.64I Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NJ2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`rS Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ