Tp�B�~K}��E�����µ��bS8]B`|��6�z�������E����櫜�| �l^���*��A,\8����{��Gu�ܶO�}��X�Ge�Dd+�����c��C��',�5�zz��݀��bޯ,]��v�ϴ}�C�;�<]�5N�ŊS��1w�:��Jj��'�����Qwu?4�q,_�� ��������cEM�������ѯX�9�>&�����'��[FFG� ܂�<��o|��ZY"�A����}6��srl�&k�ΖT�/��Y�����nT����kt\��}2h��pm_�.���o[3���%cz˷"��X%�s���$\�T_��{��{s=�JQs����?Ad�9�{-�_��9#=��eyʚQ����Xz;2V{��F�/�}硝"��qV�$@O�؋W�fx~��0�!��ݏ1��=�A�q�>v�]ޡ�d�e!�|��8��n��o;|#� SAz�����w��qES^X��9���̼P�������!#�QF v��g"\�Q��O&1����uk�;+���sg��#(�IЅ Vk� �.~!�;��L����Ĵe�e��h�ח�]|ɬ��N ��8����\�t��P-�Ɗ%��#�/b��2F�3Dt�D_�*qNe�^g�ҎѝK�A3�����u�֊<gt������k��C.�[-G��ĥ*P�YWq�l<��d�Qih?F=���n�)6Ԃ.���:wPDaH^֭N ��w,��Pn�{�E�@X?h� }��v����r;Gb��G��k�qcMү�F�K�}֝�$����x���i�jO����Z���r����4�� ʧۧ�%h�� �C���(�v.�,*��p����0�꧅�ha��x r%���,�6I��q�c���l���w)P�G6 A�]�N�4��I [fL$l�9$KR�q=�M�k54�x@�g��� ��̯^�%Uj�iR��I�.�֫�ʷYꎪ>|rw��&���� �l�6�lԸ��ǜ�=ٗti�IU���� H����s�r@�gM��oB����PhH� c��bg��e�� ��k�����9�9��ވ��c�.��'�����so��^����9ϴ�~K"�`�ju����}>���/�Շ�i��Ҧ��`c/�>��D��,��Q&I��屏~�5��!��c��TX������Yc� �"px�?�`�^�Z ޘ=8��8XU@��%[hҰ������$J���s��D�9,�?%�Z���}�t���i�j,����~�Zt��e"� xsݟj��\������%����=�I�%��u��y����'&f#2>�ڌ#����c�4_���M���9E���z1�PZ�hH0�;�c=s�������(��(Z����ǛD�������M��١_�k�)Yk�'�eL[`}�H�K��<�s�Ol z�xX����nqR���<]@VݢJ��+�b�����A߰ɇ�|<�h�ѿ������U��@���N��/-��� ���`��� � :4���+Ӌ��ɩ+~�q��K6-� ) 퉙+�\ L�U[��\��~�1���m9��l6���N�k��{1-rx(ʗ|�)�3�2t�V�����AA�|��}�X��'�|u9>�4Eh)��}�]Ğ��o^�W֓ɻ^���,����^�ν5ӯZ�m��+\f%���1�35��AX�G�R��D�q��?R��0 r��diʤ���Ҳ�z�U� ��2տ:8�)kߵ���(���lj�*t����ZÆoWE�0&�"6l�s �&���GtL�6��#���m�Ӂ����4�����czYYۓ���o�@k>�~��H�U�&��)�<��Ւ����t�X��v�F�;�|r�ټ&��)T�,�`F� \!{�y���+J$h��%�h]�S-��{��T�����@�s�1ZS��:�l��]A/#� (l͍ E���!b�" �����&h��uPo��K3���"F&��آn���_��!�3�<�daG]�_[¶/�K�O2�d���YÁ} +D��,��҇+�z��j����cW��W��v\��fe�Y�T��mH����n�j��c�e�O\��+Ήb��h襠� �������SU!�1�6�����c�(�V�X!�f�B��9�3����`�wtW�9�y��6��? 6E��tc�m� �ٺVe2)��jY���b��B�mfM���#���]U��;t+$��2�d�,��8o��r�L1��@�p��(?������gU>}<��6d�֤��=_6��B`�H����j�S,��A�LoE����~ћ�l����W�C��0fF-� ,��mP@���^{:�L_����p�|�<�r4[@���o0X`O���p�1� �e�UL���heJ^>��>�W�C�X{C�5ϖ����)��B��b�)�{�)1NGն����㻳O��g�u�k���d��yO����H��#�Ă�O�F��UV�������"G#2�\y.��h�4���F]����T��v���˛:���o�Äb�a33r!}4��O>}±5���x�3��K�0�� ,��i���5�X�� Lx@"��7�P �}Is��^�Ȟ�{E���]����A���De��E�����s8��4�Dɐ��,���Sz��G^V�]*)���e�(w���u�D��C��wޟIߢ���Q��O�<�#�엛d��$�6�:�A�����O�l&@�>�͒ʄ�Y�Gq��(6k���Oo1�٤�os�,�9��K�+us����y��F(��4Wo��)r�^���L���F'���G�O�]G�*h��CR��=Y!�}��X�/jlR=� 2�q E��柪ĸ�lL.ʛ�����E�CI���R������]��hnay'��M��#q�A��q�?�KV��y��(iJ?SYo"�ś�Mjv�2)��]�^ۋ��(lӧ�oHȘ��DZ��0{��\lS�j����QRy�XOs��}k�ò����d��Þ�2~/�տ<�~�}�}3�R+r<~�1��RCN�2���`�
Resubmissions
30-05-2024 22:51
240530-2s3hbscg3x 4Static task
static1
General
-
Target
loader (1).exe
-
Size
6.7MB
-
MD5
9e0eb0b30b3e446f121570ebc21aed2d
-
SHA1
ee7691a943e14006a3998834bd9dca66a4ea3e05
-
SHA256
ec1f9c5b0228e1bb2f171e7c35defc121cb167c88e29f03f0bfde1f2682aa3d0
-
SHA512
b44c1d997a689d4ea962bdbe5f66fb7d37593372ec3f38e647ac9dc6d15f0a564b408d0c445aadc829c9a76fed084f1c080bcef948bb451799766b6f7c2d2c92
-
SSDEEP
98304:P0cINrW74Jk/W/JVzM34lDHnwyYwvk8dHl7vJ/6gPFx6uayvhSLrZX:8HN04t/JVzvtwDwv3dFV/bN9FE3Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader (1).exe
Files
-
loader (1).exe.exe windows:6 windows x86 arch:x86
d153f7fba34e561bb9998caee8520f90
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadContext
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
ShellExecuteA
ntdll
RtlAdjustPrivilege
ws2_32
ntohs
crypt32
CertFreeCertificateContext
wldap32
ord211
normaliz
IdnToAscii
imm32
ImmReleaseContext
xinput1_3
ord2
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntryA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 671KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ