#��FQjAl�]��K�iw�����]叚i����@�D�Pډ��c���� ��{�N��(���nZ*2���V��Tm��a�͍ˤ�I��čZw����� ��l8������% ��ˡ ����)(�����b;���]�`#��Z��HQyҌy0����$�!��Am.p���S�^\�I���`xQe($и���m��a�g�(,��g��~����N�����ɴ�H��%r�*���R�0��\����$y���"Mz���� w.��������ޢ���n�y�9`t?]�h�wxu����A{���,[�=S�0E�5��*��}j���閏���9�L2�Ւ�B��N��3l��VI��� �,��s�"����x�e�[g:���sO�%�˚�~V�i�z�V�h-�v�$�GS*� VoD�Ñ��8��_}R��n &��[&2��߇}�lÌb�Q����Z���Ai��RX3Я{qAP<�u�sU���?��E�4�A�a9�_���}�uw_`�F;e1��4s*��a:ր��ݷ6���t+����r�"��{��-d��_c��7y�0��5�����gCȥUX���Oa�������lu�(V�=����� ��� h����.�N)��9���za�D�CU��)<���7v{(F�Bh��!���S�#+t$~zN�n�MqFyu��9����.����غ�[Qļ-���ǘ`��Ht!�w����������K���4c���HW�����M��� Gw�E�6�(�ҙ�`�l��x�-��J8=8���;R���ӿ=�$�z�cxq��'���p�?�}rl5��i����]B�%�v�z�����-z�(�Up;�D���%�㬣 ���/24��jl���]h%:2�'��]�(�����RϠ�w����=R��"ѐt�A� �`@�*7i?����� ���+.a�4m��@�j�QHӌ��@�f�~�k��(�jm���t�ʍ��&�:�tO�~;t����Ow��>�[W��4sg)��϶G�� �)�W�tX�Z����-"p"�[�:D����uԻڼ�}�Dp�F�2�S��������QQ�|,0�J �84Oz����|�v���SL��� BD伐���{��ll�FOs0����z� �%��J�Zq+�K���&�}n���5N���\ ���v���<��!�ɯ�#X����7+V��-�r&��v@�"�����k�U7S��.�j�<Z<� �I(%7d��*���P^~�)�����9B5�d���ꔽ��4ۮQ# ����������6P���q da�D�NuTz?� �@}���3cKB��pl���9�'��M�w@���������B �S� ϛ���s$��7�Ur���|S@��u'>��,��5�^��7��h8�5�go����1 �w���r.��>�}�Fǭ��J�s���Y����4�b�@A\��-y�y�V�t��x$ħ�&�k��<���E#����7���2��C�$�R���tK��y�����H'�{�Q�dM �r���iuohPv�]��i�L�;��}�"EmUPd`��n���'�DW��遷��� b�U����n������@��D/琙P�GI/�aZ�Y�Ѯ/���4Y��3C��*�lp�#��T�^�ő����l�(y�E���blj��&m`����˥`|h�C�ܺ�| �MK���� ���y� E+:]d\� p��`3����ʯ���Gk�t�ܬ�g�5g`�8'��?b�-@�t^ld# �va��r�N���rl�`��D�V��Qh�P���b\��s��SRQ �n��F�����k��8H�Z?H����w�2��=����`s���^x K<D��ϪQ̛V$9X���j�zJ�?��W��׆��� ;^�E�/U�Z�,[\,�������j?�Xv�������\�~���8E\*'mڶ���@������B9�_F*H�a��I8��~2Xpm�IC��Ϧ2 �d�柮I�����z;.���Qζ�y ���Ŋt�j���'����V�9�]�0#2���Bo0Z�/LO1��s�`"��{}������hb̎Z,l�J����-a☇��qqW�(Z��8VPZdc���p&7�a���^�� j�(\�#�q��t�S�Ni�8ߣA�%c�CLں�r]��LjBR3�gqю�qy���#Q�j�f.��O���P/���7 ���ȣ.��O��� x�zX�i4�T�nW��B�D�]�c$�_QjC�P>Z1�E�DQ�lo:r�;�a�q&���HA+f�H�9U�5�`2�5!�:)�r���uBH��^���l[XF��~�Ug�x� � �r��A��`�$HXL�k�n7��0�윸��S�������c�)�.L�@F%.��ԬS��c�+�.j�"���Hds=�k.�[�q�����|�%r>���b i�uY��f�_�m���\��CYba�*�̟�)�) ��<�}4��F��m��8?�����w������"�9�A���(d�x�Z=z�ED��Z�n�J�/V�=y܍�Gu�QM��4����^�^��}�z��N�pn������y"?��0$"�o��Z5�E,�XY�*cV?�O�r$����\�:�jb��Ds�-[�)h"=�0Yu.���{ȧyhrG�>�wm�`t�.��+��!����._��hm#~�I��������x�����坻=06!����rQ�sW"�굓��t�.��V�գN��nbPy2T���� �6 ����P/�_ ��%�����6;%��O%L��/ѿ����(>��ʳ��ND� �V����U�c��0��P�|�42��:�.��"������@�s�$:���$�C�2,'L-�Ba�a�0(S��(���+�:��� ZM99�+��}F7�S8,n����3C��Pw%��o&o�}��/�=7Ij)���( w�:��9�1��=]�-��|��64%�ýqlf����X�e�sAI)����5����T���u9^y��+��D,um���<�O�^��6^�)G ��4e^�*��3�/<������y*�� 2�S������%�@��ԓ��딻�ԝ�A%+�wM�΄�O~c�nm��P�~�#��vwXt�6��ߦ�"�_T���W��Da�����J�Z�Y� ~��*�>���)f��=�w��r�d�I����貓�p�k$w���OD�;�B��|t��2E�Db~^��l�Xbs5)�8 ���L���a��gȊ�V��� ���<���89J��O��)Z*E'�Ht�6!��|J�vz]b�@�,�SO�Ϲ�X�R,�҇p(~�w��ѧ\Mټ��G�`�� ��K7pUY�M��.�?�t�iP�J��Zw�������pQ�4XXF$ ��� �][*I{֪���21�_��N7����~;�ⓁW�7{�%��I���/'u�̎#��XmW�A9S���2!a�{b��hڶ!f=%۳4C��� i���H��պ�z�'����Ra�1�'��[Q{�2�b����'��g>.L���*J[G����b{�RmVsi�G�O�\���
Static task
static1
Behavioral task
behavioral1
Sample
CreateUniqueLoader.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
CreateUniqueLoader.exe
Resource
win10v2004-20240426-en
General
-
Target
CreateUniqueLoader.exe
-
Size
10.5MB
-
MD5
7194ecdb0b4d0100f7540af1992ebdaf
-
SHA1
4c9da9c4f989fa63b4bbb4356c27a294b4e4d0d2
-
SHA256
aca96d3e5a598d077c91544dd0f6f29ada2e83ab2882aa7c58eaeb00263f5910
-
SHA512
ea060f0e1283548f6d50d9c48f12e9a9c9ff519a0ad095c32fc8f6fbeefb7f833b60952c836e5999e3c836f8925cf5355b4bdb7de62ed2387adc5af12e1e6913
-
SSDEEP
196608:B05GaWv7XLn0xZm7ilKN7QAXNy0YgUpr8sU3u1zRiUQ5Ez3wbgUy9Xs:B0QaIvnrulC7QAXNyFVpdBaezIgUis
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CreateUniqueLoader.exe
Files
-
CreateUniqueLoader.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 596KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 75KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 38.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE