�, n�1M����z��bV'-��}n���Ѝ��V���5P^S�Z���{��>�go��:��;�}�껕<<����gP�� ��� ʐc������%j#�C?F����`����Fll�1B�9��X����k�K��n(L�b?�| jph ��"H?ځ��;�/s�X.@�s� ���ҁ�ȹ�;��'��Lm5h1�*�?p?�0H�=Y72Ӂ![T��eBf����e)ղ�jlD&�� ���/������lj�����5HH��߮�=���R��a��اC%F��z��r_)�_��`)Ϥ�.�ף]�<��Q��_8��;�9��l� �_J)���K� �>s���T�*x��U���?%XJ��AmDC���{� =7R)�tʼnB�T�J�Yiz��I�Ԭ-��N)r�J4Nto� �dz�����x��< |��pr��I"��,��ujY����y��L!0 |�_�Zk#�ė�a) b���R4��*e�����e<�:C��V8p�����>�iڈ;���9$���ri=1d$Šw�,�����ɞ�����my�/׆�ͷ@m��#Y��Z(�i �H�'6�;�e�(*�rKB��b� 9�5rn<�q����(�� %YW�N���|��#�V�H�vn�8|�k�i|Jo��$��Hʘ� ��0�aʘ�yp+������n&��`�e�6�,�+NH16�\��ƂP��T���u¥8ű�O��Q��e���Rg��X"}x�5��7�N���3��xUa-.���4� �6��ȉ��k�0�S���4��g���QͶ��P� �o��QǓ���7"r�)8�U���u)����#�E���X�(h`�p�/�Zc�J��)��c�.@s�<1�|p�y��B3)�q��E�D��a�[��l'v�fJ��$�e8���{!�k4���>2nE��zU��9<�㲈-.eH����|s�:�̀s�=���o����Bj� �c�m6h���.[+� �ih�̻-����oú~�z-���ѡ�P��К��|\M B\ǀ826Y� pw����ݵ5���*�|��V_D����)�� X���rJ2 �ß�'i�x5F�h膘���.�>�N/�Q�hKK�ڭ��5��� Q��Q��ſ��q�����J8se͖�N���U=2ĒJ�b�kOH{Ezx@1���<w����ȭ[;y�5�FqnӯQh�B��Ή���7��R�Jd�x� "B}�l�k�.s�H�$Jz�L�3l������Ja���z�FS�OJ�]C]���:���[����(E%�s\����t�85\yy�%�يkR��]a��An���R��yS��a��q8l���Y��$��������L����a�P�y_��IX_)s��x|��%���hD{J��,�k�Ȼ۾��/O�y��� ����լ �l��ի�R�v��OE%k���L'�Y�\u>�HF�4������ԩ�=�Zb�%���a��Ԋ�F*�}��,��~۾���qք(����&&N�㝓+�:�(����ݓbg�`�|0�A<�lH*Go\���1�fl qϚ�X��Vm~���]y t��W"f���% R���2�[FwL�(���,ۍ/��S�M|�/�7�,������ p��_dYH=�(��|�܄�q��\R,bj��6��A�>�*���\�G��~���������m��>��k���^�G�K��i�����-wI��H�&]qh7������e��T�nPVb�e�S�dǴ�1~i���7�N��#S�x��'{�*�@�R�*��j'Ȕ�~YĎ��ԕ�8�;���4V-�}���"���ݮ���b�۵�o�� �2�ee�-9����M OPВ`o�Αq��QI���v����5�i�;��%I�:�Bh�$+OH��®�LrD���'2,_��z�����(��Ǭ�� L�pق��L@.t���u�`,���%�|H(�,�LGT��Y�J��kZx��pd涜9^ˌ*�mG:�6�t�%�J'$��~��e fA'��t�B��Fi5�hzu~���� ��#X�ρb�T��XŪ�9� )^�~��������Ǽp �r=���F�>� �ͬl��wv���Zk�@l�$��ƝO!!�dp���:��ޓ�c�oW/RC2~3��/�K��H�L�C3{�|QQ�I�x�zt7< ���@��+8�V@������%^��@z�����֓�F�����pH��Ƚ7�`�!�Xz�l[�����o�WX�N��s/S���YJ�g^q�L����~� !����J)y� � #'ѿ�Zl�'��t�k�!v��!����;9J��\�F�x��qf��������糸)`�=�W�H����9k&�F/^�.�OG��������@~�,!��"6�����H-���4��8Ǧ3"�&�l�-�P��@ �� �_-����S;J���ެ$�<z�̝Be �����C������=�}u�F��M�n�Dqs��$M�9�,���xp�$�;��<�"� �瞨�1cx�u�^z�qLSF���}Ș�5Z�O��[L>�ȡzx�vzK;���z���F��er3mq!�Biʙ4g-��L�����e��N��9���݄�* �O ��A�V���မ7��t�~Z�ט˭<R����JA�R�.A)�δ�q��("9:��\J�ך�&�`85��h[4 0�v�nk����V��}U�i�yS�=��l�1���@�'!xK�n��o�u�E�a`,����N��J��ְ�I�#R}�Fk6��z��X`� �� ��y���g�7kS]XU�0��L��KY��"���F4VK���Z�>�8�[Ԗ�ii�et��sp8�C0�e�Z�����îo���E%��Ȭ*/�nJ�7[�ɢ��c9���ś�����1��/���c��SY�"�a�a�2���7�=��Rr)%J�a��DF�BN���OƲ���y��j&�� ���p /�����q=Xy� v����A�rC���i�uN��|�]֤���J���1 ��CNP"P��>3�QTS 2ߘ����J�/�V&{I�#9'���/��'Xe���
Static task
static1
Behavioral task
behavioral1
Sample
Loader1.exe
Resource
win10v2004-20240508-en
General
-
Target
Loader1.exe
-
Size
6.7MB
-
MD5
74106d6953fdbfc22da59ff969a4d176
-
SHA1
54fb29242e63c51085562216a09d23d03f7dd799
-
SHA256
27d865a8962f436da1f835e3af7f22f16fb792b4b34475f8c2480296d4552dd2
-
SHA512
3b71fff0881371cb4d7191186d8001210f6a5fac0b381f5e0090e5478264e854a6a4af346eba3ec9b156e52f4f8d9c7928204acaa22699f35f46a77f66839d8f
-
SSDEEP
98304:8ekM4K0VeZhE3vKb/IfUflGxA9t0bZFpS71w255pctcM4+dMJoQ4:8ekM4K0VeZhE/Kru0lG2YN6wmRIMJov
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader1.exe
Files
-
Loader1.exe.exe windows:6 windows x64 arch:x64
d32e5fde24080e9fa04ecbe3d123d533
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
wldap32
ord45
crypt32
CertCloseStore
advapi32
ConvertSidToStringSidA
kernel32
InterlockedPushEntrySList
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
xinput1_3
ord2
imm32
ImmSetCompositionWindow
urlmon
URLDownloadToFileA
d3d9
Direct3DCreate9
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
d3dx9_43
D3DXCreateTextureFromFileA
ntdll
RtlCaptureContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nigger0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nigger1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ