Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20240426-en
General
-
Target
loader.exe
-
Size
26.3MB
-
MD5
ec5c5985631307d5e78bee7db35b8559
-
SHA1
e48d6af1a1c4dc10da8ef37b37ffeee86bbd13b0
-
SHA256
9a948a9fa803418bc7323cda6bb266d03a5382445058ec6b53d968f6002be5f8
-
SHA512
b2bb00f7f745ac3951ff8f82a488bcaab795dafb6d4a13c2ff9b13b81329dfd059edc4514effac811c770718b0ff56343d5ce028a2465d76ffa9e8a377d8cfb8
-
SSDEEP
393216:HnD//nqv3xEB0mOTco+Yq8i7lFLNsZCSpw1fcS9u15eZCJ79hguDi4TsZylAmhrP:HD/q1nWYqnHeMd79uTO2fxDbDAO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:5 windows x64 arch:x64
4d4988560fbc9b1345973f8fcb55975f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
CreateWindowExW
comctl32
ord380
kernel32
IsValidCodePage
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
OpenProcessToken
gdi32
SelectObject
Sections
.text Size: - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ylg Size: - Virtual size: 15.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'@: Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.# # Size: 26.3MB - Virtual size: 26.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ