jڮIk�x2�Q��h��S��F��x\K_�r\`Y-F���{&(샦����&��ru<��t�$l��r����8�[[��zŵ���A�[T�Ru��{ �ۉ�imm��Y~YV�CrD�ۚ�=�KdY[7��M :mo�d��Q����Nc�ڷ�B/�e\�\�)�H��Y�����Լ���_�p�'���L��(��c�Ϥ��DL�[��I?~Зy�FR�b)d������ws`�M9.�S�J�^z�L�A�>& ��� �yj7Er^dv�Cp�J���0�C��;}-P�z����\��Z\5����-4��[����:��|C(�K��$�j�EFb,�uŀT[C["h+� A�A�4�d��G&���T+��6Cݵ�$^�j�w���cOBde[��G�ބ�s�=A�_1��q+���8��=�"�.���/��5���@���t�յD��+b����!,��0s��3��O$eN��V1�=�y�B 䃚��6�� 4Kݒɨ�HrhcrƁ���'g�� $8�gtA������]s�W�E���7��AۘS������Y^GbJ8�K'iHm�F�4.��d����/�6�B���Ҭ;�X�|�R'h�,�b�0Nb��p�7@8_/��w/�N��F�@��9{EB��~r���8YU���F;���p'�X�!�F壦ׄ��g��Z�Au�}��8.�<����_��܂�pU9����W����$���Q�;]2�q0���a�wWaG�l�Ο���S���|��L�,A|y�V)�*����kf��%q@�_��@�)k@z��Ke�>B��]��C,�L�%���k�%�S�-�>ib�+�:�T���wi/& �"���$�%ţ�e�:�����\ьG�D?�);2���K� L�wdT��XF�d>5�W�����\� 3���j��Q�T ���9�q��V'��ze�������_��pDgI�JLp���=�M�w��J.�*+��� ��0��0WTs:��mzu"�K��P0���)Zx0�y*����+1o��0T���Z!�E?e���t�_�־���[&�#oΖE=%@\��X�h���V7ghֆW��զ�cE-Sr�l�Z�j�������*x4͟x;�S�j��� �*r����_&�Ŏ���q"o<�bvzZ���y����~ډ� .�3��q����0���2V�p��O9ق�i���6;8!�(kvM�������y�y{��nYH��GB�R=Fs`�%�&���� H�K�{�檰{D����$MUd��x�/VoQ̵u䁶�1����j��Xq3^�\;�}�y]$k%�`�f^��J��>������a�]P�3����G��=��k��� P�gȊ��7O7f�<~ff8�I�ݗ&�ZÁ�h�m��DI�v� ��ɒ�$�7b�+���V�P�n��}���~|�҆K-M��-�MG)�{iH��\\���n:m���̏��cS����6'��!HZ��:�8�o�Tqy� ��:d��fvH��+Z�w��V��0��4B����έX``���ň{�4��.�y�>o臻�q�7Nd�K�BwS� F}���Op!4 ���g:p���,c��z��}�R�/������&��_s�f��%�8��e��h�� Q���}̥��9�������"C��!���~�2-K{�uoL���or+Td��<��*��ı�]�&��<��j�~��0?�mb��G��6/��������;�����j���7Q�v}�A}�8m<�� NҶgwy}W����S�[I�<��Cuw �!�:���1�;�fp�W-����: u��A�[�}�� ��0�U��OQI- 2"��/�D��!^o|����hBt���e�k�[�\a�2��q)��LH��WN�l�d�_>��9ف��7�>8p 4���:�����.E%�Q|�گ����{��LsPδ1�w_Ƙ�+*���Ob��q5و����K����D+����kH������i��Y�c=���-�A���^6-v�B�D�>ͨȫt�@�� 3px�8��3ҍZ�q_�aM��"�8�~hgm��$�r�;��'��DP nت�oL�������6�d�3�xR�� �3�� ��+zcd���w6����G:b�ycy?Zڢf���,�7:�ti����O3��K}}�pZNe��H�$�1�$��El��&A��>�8R;�!vl-3lC��)�Zp�i:W ��X�"�;���a��Ե���%�g�R���F9���I kw�g�2m�j�y��;:Q�H��Ѝ�8��% ��`��ܪ0��h�����y ������ͻC���@���S���+��E|�˞ ;��5d.��G���1��c�m1�/{?��9Mr�G&�*�'��s�Z�1t/`!:y���Ł�y��7B��8��a�aD��iD�8��= ��QDz�;7�Z{���A� ������0�`*~�P:��٘���(�]M���4�H��(7*��`�E#��j�l����W������X_�d�De1O�=��� S��r�e�a�C�i2��q��cm�,�@�"�J��J�d�5����x�'���Y1�x{�4,o�<����E�K6��`Å �ա�����o��_�� �itg}g�±�}4��P�=4�u^�&iD��-��O�>�+�h`f���9��ܘy� 6`��i���q�9We�1����Pȁ�7�~��;6��h�z\ԝC˚5� ,��n�s��K�e���kX���/X��0�U�;l�����y�U���,�ʔYa���� �5O�J�^�����4�|�Cw[��{^Z����n��j5��=��Z�<�w[T��~.|��sϋ�b&�]�S��@�"����d<�l��J�Tw���_zзp%,2l+�o.�.*��E��zЪ��ֆ�>�4H�#X���oh��G�����ʇ5�^"���3�1 ��u���6�'{�V���z#�kȖ�� �y���89iR��J����Ul�]
Static task
static1
Behavioral task
behavioral1
Sample
LDR.exe
Resource
win11-20240802-en
General
-
Target
LDR.exe
-
Size
7.3MB
-
MD5
53f04e17b5f9709e3d09b6e6418cfd84
-
SHA1
7e2b734d0882af54a9a5b75891eb984d75bd8337
-
SHA256
c82f3ebd5088a9c448fa07307c985cc1e1cfbc6368af1bf6f1d3f09902facd8e
-
SHA512
da84d2ced341970d6b0346a7f51a1a9118721d1f8e2968a42aae09b4d0f5878a9eadf10a19249ecde9e270b751c38170adbeb62ed9df5da2e054a2e2b2f2d6cc
-
SSDEEP
98304:XPmtZIzzL0DRmCHGo+KYEdCrsLMudTe5v7kpYlt/YZYguAJYFqwrzwpI83p5LqXw:XYIzzKXH8KYJrolAASaYAAr8Dp5OXw7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LDR.exe
Files
-
LDR.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 239KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE