X����pLR=eُ��Þ�W x<� c'2����܈�r��l��ƂK�+����4��i��#���=Йl�__��������M�J{���� d�j�m��S�j.�vk_�wp�������~�7)�|�[�3U�w����ۚ�f��0�S18�����>/�B`��mc��Պ����Fa^�کu��|NX>�cv�e�!)�~�'(��Vz@��nG��U����w[+�?�Yf�5����|��,�{M������bv�1�nVv�) {Ti{3��|�Q��>��ʨ���b����`4~����]�9�N��@�wr�� ��2��B1$^B���+�zYm�t�h�/�j ��Q������v��TN�ڄZ�:ݳc��Ֆ:Ɔ��3ɋ�0^-��_��"L��D�����>�Y�V�������_�v8/`{�����9r�/��(a��#� �������*�\��q������#��T��8�����i�9��'ڐ����%���d��f\�ׂ����Z���h/dm ?��L&�\��|LLl��@ �<��&�;�ר��X#Q�{K.��6Yv!�zϨ|�꧟�~ �w_e����6� � 8}?�a�[��Ň�)yj�ƿ��xUv�LL=��J�/��й��]-�2O�O`��m����M��z����� 3sK�� A�y�g�����D)�"��W��)W[���H�� �6;�A�+�0��Ԁ�\�|��/���~�v�����l�o�b����ԼZ«$����Fm���@]�%�;�<�m�o��8r����>����}��w��ݗ=��j'����������c�o|�%���{���]Tϭ��$�ݳ�L����]_�y D}a�Y����ː[W�;,�yk~t�M��}� ����#ϋvg��i� 8_6��{� H�hwS4�:��y<M��>���?����e���!{:�%��!�Z~�Ch��'rQ[���K~��\U�J�"�3���>1B�2!���L�8��rk��p���{#��mE&��Kl卣X�����3E����y���(��q��+����>*��_��֍��7��d�i�y�6��+kӻ�S�*<)ğAc� �kE�S0���֡����>��H��g�Qn'�J�ƷԹ����I��X���p�4�~��%�-l� *��y��������MO�����YzH_�H���y ��%����i[��7����q�X�C|�#@ڔ��U��!�+��S�B�o%� C�.�ɮuѿ����{(�]�юf6}��ߟǶ'���V�s�(�F�h����cؼU�~Ndi>�"�p�����H�����EȌfy�g�'K�or��J0����srX�|D)Ci�Ml�n֭���HZ ��jjl����]� y�1�h�݀���pՕ Vr�㙇��}9�vr�*-�~/]�A�d�0tD7��k���cnƾ9�~���=�z�ia*���3�P�/��������r��]���2L7)os��!���Q��ik+ɇ��K:I���U>%! �=��=�WxR`�C��̎��zjL}�+�P<�&�M����l��5�+ぜM� 0� m�|m��v��jBHAb�?���0���0Ñ�#-*���c_��N,��u��U��@4M��v�����U7*���@�������C|SX������]��`jQ[9�"�+3���B�[�Fmͅ�ӈՏ�����9 E|����Sߜ�iG-�)'�v������=�/�������hL{gh|a��i���!\h|�+���Ǖj�����6OaF��dr*YH;����<`ѣ�Z��9%�O�Ёa���'5�P��T������{Bϛ"�L'K�O�N{v]�(�d`�\bP�L����[ ��3&�*Q�r��Cs�`Evtkyh��� <6�� ��2���FO=����;��(l�V�l�?���o�w��>K_�����oxL�Hf�d�F�1ںu�8�/z�~� A<�|*J���oķ�c������Ӹw���{��2m�0����鿠5z��yo ɎV\��1�Gjr�_c���^E0I ���lA�� AXR؎� ��ׯ0�97��6[�����~ �y��z=r��zNx͘,�ǧ! �]nnN�q~�:Z����'��il _*��?��a� {�s��4g��6�a���9�v#����ڪ�S{���� !8P��q�_�c�Qa�?&� W�|"�����Iqݓ��o��l���U���( ���s�|Kxa=*HP����$lR�f�U#-�����*5�T~Xw��W�ԄWA��Z��G�ҧ�J)`315a�q<��0q� K+�H� �d�Yw�T_ �� x^��S�Ӹ���/�7/Vz��q�@�A?x�������g��zX`:� �K���)��R]����������Ӛ�ۘg�`��E�F���;.PB��[�����O�����$ 88pO��c|��ӭ)Ͷ�c�p����P~��}IGM����{=��Ȝ7Y˞�W�������-��r�ۤR��N�\�74z�S�ٿ�k�@�/E��E���D����\k�"؋H��"�`�7N �_���9�ȒPA�&��F�钫 N{�C�7�]���ʵ��ę�{�;�[�ZJ���������7�sl���_a�m�������`£�E���ji�l�hX�� ���I������RaZ�j<�� ������_�H�#5�(2|P�ڲ�f9�=�]!������h�ϓ���5 ���Q�!����$�l�(���<d�2g5z �G��P_��fv\K%Mn����bT\˼�d1E6R ���O������;�d�,��*O)��zr<�,M��e���G]��?�I(|S��D�"�ƊK�7�>�:m����6s����ղ3�-}=���W��im^�W4�"nW�@�\*�u|��'ZX��/M`ctNY]����Y�T10�G���ug�[���ZdA��������w��� ,�̗[W6�`��X��o��<�Ko�`�E��I�?�Fz&��ƽ��5�
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20240709-en
General
-
Target
Loader.exe
-
Size
23.2MB
-
MD5
a0289655ddf8756a93dee81afade42df
-
SHA1
1d429c7a4995a0231627f656ed67be59d1370df7
-
SHA256
d2dd25171915bc8d4915e1c9648ceca109487d088d326c30f9d291fabac266ea
-
SHA512
4cebe452da83560ff4fc76e1bce0f14139d043cea812fdfa275f18967ec1e112101e3fd99b608d33c0fd40730a9e2fef856757d82460bcb9eff6fe1deb4c1051
-
SSDEEP
393216:I06pxyVdbQXxaNVXPjflDzCWAzYatXRSP3D0M9cAWfdbewnYLc2jgTEM6k4fVW9q:4wn043XPJDzrluQgdP2cTlNQYM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
cd8a6d6a62d8a1ed0a9a27531a4db896
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
CharUpperBuffW
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathRemoveFileSpecA
d3d11
D3D11CreateDeviceAndSwapChain
winmm
timeBeginPeriod
winhttp
WinHttpReceiveResponse
Exports
Exports
Sections
.text Size: - Virtual size: 967KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.avyu1 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.avyu0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.avyu Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avyu Size: - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.avyu2 Size: - Virtual size: 22.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.avyu3 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avyu4 Size: 23.2MB - Virtual size: 23.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ