i#]�.5���csd�Q��!�W��ȅ����qbgA����z��22<f���[�"Fη��� 2X�����C5Xs"3���_"���c���u��)��1���N��6uvd��!p�����K̴��c����B���A�5q�5^J��+�O�A���D��V���Jl�t���,(�#j�F�cya����䁵�bF��fP��#-"��v����H���E���)�Wc_�gY��b���� �-O}�C ���-�Jw����a}�ܚ[6l��;���_*���>M��V`�4�QWOb�|��ij��W��j���fZ�N��a�������d��:=�.jV$m��j��Z�~U;�b�K1��� i4H���lV�4������ טȕ3� 2����>oC�6[=JҎm<[���ȱ ��Ee��4����Ѵ=��M��2�ޕ1��$�����CA�����h�>������x�ثSb&�'g:"�Vm]�:VTǽ����m�?�~�����ae�g�hl�.}��[email protected]�T����Ըj���1�nw�,q5�0�:߱?cWƌUs�NH'.ϫufqԜR�0ۤv�V�A�!����T������DɄ�����gF�hj�N��.$1�FB�t�����L ]~��yrhĻ����,�M�3}�5��&�O!(pWhXQ|�����~1��6�6о|*�_���>{� �Hx�Z��x�������/���A�8v W�Haf頔?mOĺ���������͛.����t����~��G-�)�>�K�϶�����{�ȇ\=��2 ��[���'��o^�o(1�A��QzA~@��8�z�F�����AEn0��Z`s@����� �p4�ǽU��į5��!��YpA���78�N]%�N�,�Lɱ-\��s`\�#m�P��,�ޭGf�m�>Nr��N��G�|���ny$��h�2$E�]�I�u� /�[���k���y恿q�]=�|�b�ꑈH?��r����>ϗh�e}���)���ҝ��r�-�pn�DM����{C"eB"���J{, ��̫|��Ї�$(C��Pu`�����Iq �*w���v�2�'��\m|ȅ�\�r��{#��+[�LP�=RQ;.Q��i8� ���Rם�hC��Z���ӷ`��gP��[��+��m��9��uy7�w��#�ѯ/��rիvfb���Y��Ej��\��'���/4,C�r��T�/F�?���'_¡�CȺ�;@4Qڅ��_��y�[C�����bsf��d,X����~�H�R������#9{Ɖ�1IW��d� �c�����T���F�5V.��/�4�2w������������0���e8;����sJ�����jK&����Ѐ ��=��mv�P�H��J����L��y�z�ϻ'.���������e�sF`蚈�4\�脀䣤�bKS=�z9 gۑS�Y��t}�!0����z%����>:]���p��<t����A�1�=�lZ{�fcm*�ű5r�|�|w)j�����#˝�!9��t֪���-��00}!�`����6�sW �����WPWM?�і��3����ֆ���-�ݟ�~��**Tu������M������n.1�P���{���2v䫛V2�@%0m�DŒ�H�>a��#��,���� ��J0F��J�����znQ�۾꧵��U����K�!/��ˠx����9�j/]�S�����%�F�y2v�m9�Ko;-�^dJ���w(��A��KV����y7�[��ӧ�U�ka�1��A��SU4R�nZ�'���/9�Ph�7�=��p��ڍ ���t�?�1�/��aA<���%C>>8%n�i�__1%�~�XqӼ?��W��~�����S��Iu@#Նع?Q��]������e���Y��==!e|(B�u�{= � � ���6{`n��lHi5�?X<�~��^���/G�d���aYT}8"��A�J;��Z�����rir��//����� v�Π�IUp+�n|��d�����ђ�$E����"<%��R�)�i<8m�l�M�GG�X1��r��4��{��S��H�Ia)Uh<總>��c*H�<J�87�3⾅|�gQ��Z�? ^�H����_�(��"XahT�S���Gsd�Zqw^jC�(.� hUmU0@�w��j��M�(����� ��J0��*��M��i�4��#�h��Y#X�#��y�/��YH�������;ʍ��=-�כ�n�t�?q�5A�0puU���Q<�G�Y���50���x�Z�f�*�j��j����s�0�I�^Ŭd�@�1BzO��'���"�d�Ţ��Pu$��<��Q� ϳ���\�87'[����QA��0�V��1�|5�gղ���-`��\|��|�x�T�}�J�v���t�4D��7���H>u�Z�)����3�k��u�O0q�+`������#�!k�S.����}� �ؼ��;u3F��l�(�4�9 p< ��DCF��������c��0?��<�����y�UW߀;�Z�]}���=Q����)rǛ�F.٥�� D�����Ad�氖�]BsZ,�E�#c�C���ג]�x�ޘ��hLXk�Z�k�����x3�9>;�7��UE}�@�?�ǁ��1��`⥘#O��ÛeoH�����i'T��Pq�n���0Y��������yYg�n�&U��In�%�%�4���y��"�1�@b\�˲>�`�%�a�yUCu��G����cO�9�`��;��=p��t�V�*�rY��J�W7��X��*dK:��uWĂ��9�Rc����$.[��Ʉ�� �~T��4�`f�m/`� �����<�������7���dIh,F&,�0M����-�i�����#��N��Q��t_$���˳���(3�l�.;|n��hT,��B{k����;�~])'�,���������S�N���3��o�E0��&�+�,�(�汿���lͅ��1�Kr���\�i���3S�+�����&B��0Y#�^���.v��>���3�:����'ԻI��#e�7@�!f�Q�%d1�� �;i�&3��pS
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10-20240404-en
General
-
Target
loader.exe
-
Size
23.6MB
-
MD5
1fd44d4d2b61ce6ee2a9d45e51c4726f
-
SHA1
9615544662163c504701467bcbcde6969a1fafdf
-
SHA256
b7ed616ff514bc716f3a02422c7b7450e3132e92eadc14f75dbdd1d19fda51c9
-
SHA512
750f5fe73628d1206001957e75416faa04b8ab81916f1f25933fb15d46cfbaca3b357881a79c2f0b61cfc5f7acb6e788f1288da684cb175a73699cbc4391ca56
-
SSDEEP
393216:0q4UglGmWCtppmIevF7wixPM8LqN5zkFUipQODPn+7KSiY2i+g0gNFKgddEL7RfC:0ZUUJ7tpoIqF0iNzq6UipQOjn+7OhPgN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x86 arch:x86
364c126094beb93bbf9bb9cce9dd4e6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
gdi32
SetPixelFormat
advapi32
GetUserNameA
shell32
SHGetFolderPathA
ole32
StringFromGUID2
ws2_32
shutdown
crypt32
CertFindCertificateInStore
imm32
ImmReleaseContext
opengl32
glClear
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N20 Size: - Virtual size: 20.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.N21 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N22 Size: 23.5MB - Virtual size: 23.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ