Static task
static1
General
-
Target
TIAGO_LOADER.exe
-
Size
20.1MB
-
MD5
cf813ff8bf9e59a534c84bd845b4f32a
-
SHA1
2476f2c8f0913b161d5cfa875cc3140ea8677d1a
-
SHA256
70a29f088ece5dba2dc117d68938e44a2dbef23961324b03d09ec201514bcbec
-
SHA512
26fac97744de04f6b89c08c50ebab2cc43c9553d08ccb99928b88108eb5dc9f66f624febf077f4ff44d756986c2829ae2840101d26b6470eac7eb60835ca0a05
-
SSDEEP
393216:vmB3LumqjfFb1UJP9VRYERVbELEG27LWTnAouYv2w0xx+3:87X0FWimn5FHxo3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TIAGO_LOADER.exe
Files
-
TIAGO_LOADER.exe.exe windows:6 windows x64 arch:x64
f125abc7bfc22a2640f858a44f296777
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
TlsFree
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetCapture
advapi32
ConvertSidToStringSidA
imm32
ImmSetCompositionWindow
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertGetCertificateChain
ws2_32
gethostbyaddr
shlwapi
PathFindFileNameW
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 955KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.5P" Size: - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.A~Z Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#z+ Size: 20.0MB - Virtual size: 20.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ