#R��RN�i:��&��h��� J۽�~��@���T���~�ԭ�_����Ys�]t<�� ����rЎ��9�&���Z�Ѹ�:"&{��P@;���l�J��r||oO����<X�RѪ5ܵ���\��S����0��y��s�<A��D��Jy�O��8��is��U�_= �/�ƨD��}@ '8_�F������2hۺ���n�h�_If�2ˈ���� ����zQ�-V�����I��6�A���"Y�������3N�KDh�� s���H�� �E=]�Q}|�6gG�JV��-������2����a>r�ϯ&BߧJ)ڶ��ڇx����]�yGIK���PԀ M�Y�O�XwkW�)�iH���k�|��5=�G��I�^������%9[������\]k능��_����:��;L�'��}-^��@��������®XT�$�Z��`i ��d�˷����jp��:M����� /`��y��.�,�ͳ�3#�3&����Zag�v�^ӳ9A{�厎�b����l��4���5��U�KJ����E�6�B�l �н �9�4�����mP'���m�M�y���~�tn;`�l��R6��X�ɼy�d�4,S5,������ ��̸�]Ϥ�o��h�z�aH쟶ǭbK]l"��)tV����i�1�n�����b�8K�b[6�Ç�!��QV���o�yQ�p'���6�V�4��d��H���Qǜ���~�������B�lpI�����j.ydBz�� e�䔞����Ja����dީ*��7��I�T�+��l�i�/��xe,V�q�����6V7F�e� Rzr��{ �-Y<i����������d���i�<��ɺ K?�h���#��)No�I�x�B����I�'v6g� �u��^)�w����+��}�n��8~u��kTR������N��}�0e���{� �,'���U�4ٹ�=�X*�^�?E�KQ<�H6Y�W�]7)���1����I�ױ���-�F�����wݶ����p�a��p�O�}��� z�*mљ/��[��zT��N�,�'�Ԅ���SW\�+�Қ�g��CV���Y�t'/i�c/��xP�V Iy���-� ż�ޫ���P&��xh��h{���BW��_�k��Z�j{�[=�0��o|���g�p��"Rsu�0-�y$VClx�rNs�]���r(�ᬽ�v�&"�=n7-�\_{�������c*2S��*�� ��6���i�2���4�|S��2N.֢V���(ι,Zͥ���ljK69�%�/YOr<��kL2�����z��Ķ�T�����[i�f#�cdO�_n�W��.b��M���貤�d����0[�o���^]P�K�(G���p+:�tW��4�kw����2a6��Y �|O�&����Ž�*�4���2�V���_�)h�4�߹�����DO��d���Q����[b�8{gw���`��kه��������I�V9�!���� ���Kf� E'8�r�����s�Й�Z��1��7pXS�BF��7��&$-�����.����m7Y����X%�.�F�Ӈ���{-b|�-\�Co�U��,B� Ȩ����)�>�!4����|��D�k��>�D�U�{P~������tn�\���������^��y�V�_` 23B�*���<]�S'�=>��J�d �5������/�ݾ�Z��J�V���\͛"�u �>v�*+B 4m+MI������.!{H�e �4�!��JZOH���Չl� q���6r4��E�%�U�mgSTee�G�I#�Q��ˢݍN}������0O�'R�@r��L��r@�9��W�*3e~R(Y������m���2�/�ڭ���jM`H�/L1�Z�cin D��>h�+����'�j^{150����61��n��a��P��B*�B� ��NTm�:����#����V�TP�~_�\�tL��j,��Ƶ�S���h�1����8j��V`���t��ʿ��o�x����� {.z���=y�!v�RGX���库��Z�5�?u�߄�X�)"�'�o�-Ka%��,�c[a�!XoP<��K?W����7WiJKݭ"�iuˌ����R@�8���֊�c��d�E�/WD�ػX=��{ �qLfg�{ ��C�����B����U��)]pg� ����A��N���3�s��f�45����V �QٚL����)�na�������j:k�� ��Q��%� ? +���+��Y:�Y1�q{2�K��r��� �n�^Ll�����=��u�W��d�j���a-- �i n�u����`�����2����Ԗ� H�'F���Cs�M�d��6�6����<A�B�֎%}�1> ��r�p1�@I��#S��_{ު����)݊I��#~�wQ�3������s,ï��k(�\�S#/���7��*��ݦ���O���K_��K�f�{�fwP��|�A�!i �{-�yX;�uMY$;�5�b{�@���Apj��x.�i�L.� f3O�pl�P���?��J=6�B���K� =f��<��.bA�]"��������#��|��te�w�G�L�qr� ���)zn�v��a�j���� ��hoK�/�9FjE����gb��Jvo�>��J��jϕw �[�Ψ�K�z{���l^�1�2i愢.�?�zmp�)�)�y�L��2MR �[v�s��!���:=�e���_y��7��}>"A�AN��[c�I� eg p�{'�� �g�R�Ȇ���L�H:o�9Te_�^�U4�I0[F)u��4� ���KV�z��Z@�X�ңc�Ik(đl�]�7��e.��U�tTnw�i"���+ǃ��5Z�M�f��<X���D������W�L6x���N�C��ߚ]X{|�6� "��C(����A��Yu����|�� ��|w��ջ8��p7��a����e�spWA������夸2)A��m�r��C��Z1Y��m'�}A����e'��� =��,�:%-%�W�!M>�$���E^��R�
Static task
static1
Behavioral task
behavioral1
Sample
loader_af159bbb1ec04f3cbc978761.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
loader_af159bbb1ec04f3cbc978761.exe
Resource
win10v2004-20240802-en
General
-
Target
loader_af159bbb1ec04f3cbc978761.exe
-
Size
16.6MB
-
MD5
8ccd0ab7d08d8542621686c8859b1275
-
SHA1
78415d5c34f1e47da797c79690fdd8c017a8d2fb
-
SHA256
a84b53d0ed41eed442496cddca92466ddb17385aae03dd17c0cd1c1208a4c96b
-
SHA512
f725523879224d20cdf85c650023ce5a870c98557b6c8a07ef0b2402c7d16b2575aca6a5e597c5513104b17d31a980b61b5f74bd3da4ab33d66d4f34a656e95f
-
SSDEEP
393216:cQe1/S57wQEXMn192MEeksvkco0ieaW7RVKtoUDpH2T:kBg7wa192NekS5gIcnDy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader_af159bbb1ec04f3cbc978761.exe
Files
-
loader_af159bbb1ec04f3cbc978761.exe.exe windows:6 windows x64 arch:x64
Password: 6DD56575EC93D06AFA00AD2DB88B084F
6860a221ea545253abd577e58abe347d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
CharUpperBuffW
advapi32
RegQueryValueExA
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmGetContext
mpr
WNetGetProviderNameA
ntdll
RtlLookupFunctionEntry
wintrust
WinVerifyTrust
Exports
Exports
Sections
.text Size: - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fptable Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
."+I Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.`Dw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.81x Size: 16.5MB - Virtual size: 16.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ