^�F���C��Wx��*p�^���o,����]�`�Lb���N�ى "�F�=(�5���%�W��AM�������&�]Si�f��R�Mrqy���O����E7��^* ������D:�x��.�Ġ� '��*Q�hźu� z,YS˾���u�#$zZ���L����vB�[�k�.�m�Ev���6�Z�YCk�j~�H��wWGd�^A����ّ��D�/�0���3�J�3 (�v�Ҟ��k�������)�0��|c8�ۥې�z ��@�� [�g���ˊ��%T��xHm��C�C�}��ʻ�P���3|��/�.��'#!T��o���u܊:�u)�J���/Q�v��>�ÈU�DzX�+���:` ��j�y 'Y�?n����(�ExV�K��'6G,�(����Y��g���r��@]��;. �+�-}�I�,�p�� :��kj��1�揪�\����O˭z���SRE4��j��vG��T�ڕy�q�U�>sDl�0Z��V9�x��1i�@mtS��1=<���?b��6RU���J�����4edS�����h�0����o;m榌'��˦1<��N:���h�[@C��0L&�Ly�0ŋ�a��0��d���5f09��Zr�*z��3��Ջb��1�2l�L�nIP�C��A�j�^��9� ��{%^�i� fw�@��ᇌ�~�:������r���gX� �R�CMn����� �����+LO���E��t��3/�=sP�V�V�a��2�z�W(����<\��-�������ͮ��{��}hi sc�bV �L�bF9s�ד%%A�j�e-�{S��_��RF�,�GWY���D��A�:���Z��hn{�o��t��#�ۑ��姎C���R���N��_8�%P�yzZ_qe1��������Nퟄ(�f��#k�� ��t^Qf��E������p��%o;�����5/� P����ո�K�1�ne y��M��Ŷx��G:�L��\�92�\wF$���<//U��y�/��R�GSf4���Lؤ]���ɓ6�n��3e>I�����$A����bp��v��g��_�5f�}��"�[h�� 1}P����3;g'�!�)��e��v�hK�iգ�&�b�RZ{�\�K�*����J�1���/����\\���t�R@F�3��e�6@�iM0M "����j ��2�T�F���������V���;V1l&��3՛��z�ٌcn;���H��Ŋ����- �9=�!Z}F>h��⪱i�`p8*_re|f����U. �7 �9{(��������X�8�}��U8��9{gQ�4�6e@�$�aR)���RD\�c���Ŀ=�^���M%�e��˂��r~OLjO�;X$��-�B�%�2v��>���M��3A �*i���tI���9��tA.1U\&��K���� �}�T��1������;�F�8�Q��O��JY�g���i3������8$�O��&���|9K�'s�9�����"�4�#�I�'���B�s]�E蝳�x����ɞS�8�@2!��v?a��d�.t�[���m����{θ��2���]I� �^���B8��>"�c[ U{ �Mx/� ��{���S��OT�������Y���9�����uʶ�8�:��S&F�e��#�fu����E�L�f��"O^~�?�(SxK\.�� ����6\���c����m2���ۦ{ ���_/UBY��7^Ag�>2���S]1�����&��I��؛��<�j���.��,[�VZjd?7X�����CFm߷A�q��(�����k��[�� �f�3���y���q�"��0Lo���@tx�X�,�Q ��t�&E�c��@&0K>A���(��a���,cAC���X3IZ z�K������k�ĞCp�Of����w�����,������$z��1�jT\���5T�M"n�)���x���ij<s�����L��~�E�G #��]A�=�x3E6f2O�23����������rzԼ��a� q���.P�n���,�����w����r�x�ai�x;���+C8�f{w�N~�sL�A�g9 �T�<m��F��L��qQ^���4����(�1c���MPG����sPqBZ4� ������t��g1�в���H��F��Yl����q�J_؆$L�x���r��^�E*�_"sN��4g���xf�1>�V-Uy��E�A�M��-��τ�o]~������u��x�%�P͕����|��/A�nשeT���)��.d8��X1+�J�����Ĵ��?�6���5���/в1����;�ܢ�8����M}�À4��"L�]a�LH��Oa���/�"��y",�w�N���ZFz�(�J��.T�ۥ���N��U��0���-|�������[�Ո��VP�����(�O�C�l��x��<��kd^��%z�TUR�@Y�]�dPW�� ��|vZ�.�[8�w0��=��-�ӆ�"��{?d��'��``���������@���M�ds������d�W����AA���U�@��p��stg�7a������G���HZ��uf<�.�&?��@f���J��(l٬�7DK��Ј4 Ql�8�'o���_��O1�گ3�-�n�J���c縇��_'OQ�5�v�h����ώ����=� !B�i��?dG��pU���ӷ1S�g�/W��(����&�����!�p����(%1dwۧ���+i���c���h���u��2�!�O2�^�\.K�����lg����&�c`��R�ފ|J�Zd���1*]L�:�ӄ�@��p4۵��َ��]\ߟ�,~w����MX`��ϫ����I��ǭ{�����f�vek9;��&�>0i�Ծ�n�|?6Q FQH0���& A�ĩ��X�5Ǝ-���Ϡ3��Zr����_G�;��'S��$D�ʟ �c��v:�{J�8*�3��a��q � 4���o���z]���˂���Dިs @��ԍ���1���hp�n��Y���5��J��6L�H����-9_O���r�w��ҕ�R+�B���g�;/ʖCQv1� g���d
Static task
static1
Behavioral task
behavioral1
Sample
loader_af759131ae178732ae4f2381.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
loader_af759131ae178732ae4f2381.exe
Resource
win10v2004-20240508-en
General
-
Target
loader_af759131ae178732ae4f2381.exe
-
Size
74.5MB
-
MD5
d8ec40cd3de697e275c6256bf579e370
-
SHA1
ba5cda71a00ab9e8e332fb64e9997ffc2a84f235
-
SHA256
fe565f8da556dccbe5374d933861b5f5c8b44cbe851613ad25445a14a144b5bc
-
SHA512
f6325a02fe1576e2f33cd1e6a75261d31a1b8e0da6178aefd81b7e6e509c77e4bc5fda2be208a8e8bb3c882473d6cbeb4100837a82fea38ebc9d0e11aacbf66d
-
SSDEEP
1572864:qyTJZks2qL+kI1u+/TJEzGzhTGtWcgWcngmuOz+Ka5fkFGrmKUUxKTs:q84s2LL1uC7hTam0guL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader_af759131ae178732ae4f2381.exe
Files
-
loader_af759131ae178732ae4f2381.exe.exe windows:6 windows x64 arch:x64
Password: sordum
d7b1f8106f03cfa11252d60b3454e6c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
MultiByteToWideChar
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
CharUpperBuffW
advapi32
RegOpenKeyExA
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmGetContext
mpr
WNetGetProviderNameA
ntdll
NtSetInformationThread
wintrust
WinVerifyTrust
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 116.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fptable Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fvp Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TJ; Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.F6h Size: 74.5MB - Virtual size: 74.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ