General

Malware Config

Signatures

Files

• loader.exe

  .exe windows:6 windows x64 arch:x64

  71e6c96c79aaf5ee2ec6a7ed3bb2a417

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  VerSetConditionMask

  GetSystemTimeAsFileTime

  HeapAlloc

  HeapFree

  ExitProcess

  LoadLibraryA

  GetModuleHandleA

  GetProcAddress

  user32

  FindWindowA

  advapi32

  OpenProcessToken

  shell32

  ShellExecuteA

  msvcp140

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  normaliz

  IdnToAscii

  wldap32

  ord32

  crypt32

  CertGetCertificateChain

  ws2_32

  WSAIoctl

  rpcrt4

  UuidCreate

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __current_exception_context

  api-ms-win-crt-runtime-l1-1-0

  _cexit

  api-ms-win-crt-stdio-l1-1-0

  _pclose

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  api-ms-win-crt-filesystem-l1-1-0

  remove

  api-ms-win-crt-time-l1-1-0

  _time64

  api-ms-win-crt-convert-l1-1-0

  strtol

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-string-l1-1-0

  strpbrk

  api-ms-win-crt-utility-l1-1-0

  qsort

  Sections

  .text

  Size: - Virtual size: 441KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 107KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .w-e

  Size: - Virtual size: 21.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .iPg

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .~LX

  Size: 35.6MB - Virtual size: 35.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 284B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 469B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ