"%[æb���#�cf2�07�@,���n����Zj(�H�4Gr�X��i'&h�c�����C/ʩ��T�A�X@�]�;��|S���E:Ȓ�ح��zZn4D�U��R��Dg�u�!��%1>mgSZ<��W-����>|QGӺ�h�}tP5 �z-/��Եn� ��ڑ1L��_������%�YZ�5y=��q��x�$�{%��G�4��/���]�e�ڌ�i�>p�i��� �$�����k;q�Յ��-\�-��@�7��7a[,�YYa��sZB���E�VCn���Z���lgܦl�r(��ؐ�,���6�ï�� �v.X��.H"�� (bV�t)��{U��*`*���� &�);Y*gJ��Ti)̆o�<5�L�2䗆0j�c)� ������|��(�P�z���!���aK ��ߪ&�_��)�T#���$ԕ���FCz����O�ío�m��]�RXܵ2?�@^��C}n[BnG�S1��ɀ�8a� �˭�fʄ$�Qy�g���$F�����L�j(���x�)�hT�� Gc(��>S�~�j�>d�3���6ޣ����(�H@a3�ˑ�ˏ�}�=O�Jodf؋0��7����B����Il(F2���v��}t�:d>�:{^��2���h�"��� A��~Q@I�z�� 7R�$*7�Y����(r�x��������;����+(ݗ���ʖ��P��/�s���);c�E؟�T�zF̮�U���^2�q��գ~�yB��0;���b!���a�C� |zsoD:��L�??��A��kQ���!��h��vN�;P�t��6����'��^9!��w��uB�����U����0r��2Z3�J[����#K$�� w��z�%�eЊ���B�V.:���ix�>�3��4���,��;0K;�����K��>��ل\��l�`C��,�B�i�,<a����� ͏�A�<ɏ�U�|K��ʆ�(K�4��m����� ����x�CD��[����x]��=*�1��`n�?�ݣ����b�e�I��is�^���\9��r�gR�G���ٿ�YZ�(��� v�-`�������wf�t����o���>�W��j��r�ƋpMP��H�m|�ݸ�<E�1���g\R>k��̚�|����YWi�rc�#�tYUq�,��X�+��p�9���c�]~��j֫t=Ύ�3�h8BI��]�cg ��#X"Z�Xp J��$�\^TBj:��۠L~"8 �������K*���Ѝ�QSoe�,�*s z��ò�̔ fv�zxeQiq�u)�TlL�j�")�����s>�X��Ľ|�o�"����B��g�u��c�F5��N����xx� l0~���6=z���:0���R�����e���UvI,�hiQdE��t�>o'�ܵ��0ޕ�x�c��!�M�������Y�� �P[�J���m����A�n]���yq^�{,,��K�������,T�6��f�"$r���n�p��������Y7'rWH��!����_L���P�L���O��7!;8L�j3���HV��h���f��v� �j�]���,H���[��m��f��6��fʩ��!���Fqf�B+�DGɮ���]Mf"�y4�+�Y�h�N�zRS����k���s03�l�yє���u ������?(0ݙ��k{G�G �6ƛ��M8�*E�j��M��'m�T<�.~s�N�9J0����UҶ�Ȯm�)o�l7)L��a{PoU���F46|�}�eL������ӎ��`Őh�`�B�f�b3�0�W%�W����;2e���+�ɼE�Z�i,�m���2�\L>Rq��&h)��d�:���FJ���=5�I�E��y*Y�}ǻ`M���'AdD0��_g&F���a^C��ZD(��d�hL�I���V��Uk����,���X��[�=w�d$1f�M��{���;����� Ru/���mp����H��J�#Z^��P�ȴg� �������p��*�ĩ�N�Z0i�A�A����Y ��A�Ϯ��F�;<�1���^ʮO�Ρr7Ph=ܖ��WaKf�<���J颔�����&W�&~�"���m�m���9��j`d������3��G����ѐ>� 4�68��gk��7~yQ��ht�ĸ�O�I K��9w�w4G"H�l���p�n��,{���#軹��א&��9�/I�����C�W2+�� �n��Ho�S��8�fg5�jX��`Ϲ&6��^X�H����+2|�L�sn'�3���3�a\j�,��٧z��gօ+����hm���C��)����J����o��H1D�K��d�O�JF=gx�38��(VI�'��-�U2�]����0װ;��ORdƨ��(�PA����I5@쐹���gk&)8��F��_��BǔA����#41�϶��c�����Nj>��.�xBT�}]\�w���g�<V*��4e�y"�2��3��TÎ�Z�n����lwJ��n�E�?��h"Y���%��p`?~�>m/�L�0PizuS�R��Ρ���3Z�2Ѻ�@)�s��%��.(��������b����I�\ɬh%�H ��n��U6,��e��b� ��t��0*��|�W�!XT��欿�6�����S:���mPBp1DC.Y��=��0�����W���vQC�}�3H����sH��Fc��/$��S 9�Ҏ��`D5�JQ�~�;���[�%؋Ȩ"� ��m��x��d�3��Z�f���+^��r�S@�����9���C���i}���^�LR@T:���>���P� ���Q�b4S��I�\MQ� Z0$0�Ѻ��������<��,��x�G� ��@a�M�8�ɠ:�*DI���<�}�xr�t��0�'�~S�L���;�]Z";>l�u������� ��TCa��$}֛�Y���xM �_�\x���08����n����+�un��*vz4���l��ς�} �X-H�1H�֚���J�'p�l�|�2�Hl��:��:�|�a,6)�R&�8I
Static task
static1
Behavioral task
behavioral1
Sample
loader (2).exe
Resource
win10v2004-20240508-en
General
-
Target
loader (2).exe
-
Size
14.3MB
-
MD5
b25dd925b62d155239934f25e42abb0e
-
SHA1
6485bbec040d3ded289a42883c2442d51b24fc78
-
SHA256
a1d182b9a2665a99371019dddabe1632a74491993fe2ad50245980e5bb48bea0
-
SHA512
ac7a64367eef5ffc79f408ae766877c02ac26ea2acafda85d051d14afee468099b2f370f4de82f97ad04a6bd08a4d6d3d7e84d5515c13d9491e420a58304cea2
-
SSDEEP
393216:WjmgJa4muWV7NBHcjjiD6Bm3HflzHHkA:WRJ9muWVvCjiD6E3HflrHkA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader (2).exe
Files
-
loader (2).exe.exe windows:6 windows x64 arch:x64
01a6e3417265a9a6d08647ba1b88e1a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
gdi32
CreateRoundRectRgn
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
user32
ClientToScreen
CharUpperBuffW
kernel32
OutputDebugStringW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmSetCandidateWindow
winhttp
WinHttpCloseHandle
ole32
CoSetProxyBlanket
oleaut32
VariantClear
advapi32
GetUserNameW
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertEnumCertificatesInStore
ws2_32
ntohs
shell32
CommandLineToArgvW
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
Sections
.text Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.?}u Size: - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.m3= Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.C.4 Size: 14.3MB - Virtual size: 14.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ