Static task
static1
General
-
Target
loader.exe
-
Size
15.9MB
-
MD5
574ea5d4997571fa264fd45d4a35648d
-
SHA1
75534cf7ef999a633e57a288905abe49b5cfe18d
-
SHA256
4942a4bbd51a50769016e244f19cba24c8ec943e212af40e38a8e27f7af9d8f7
-
SHA512
77ab3b84a085f6618c8ec0f7a167e3c7e6e27c32c3feac5ab8a58b8ce1f102de4e8e9bf6e31d996020b059b87c5878be78b5e15ad802d68a2a64cf9836fff5e7
-
SSDEEP
393216:AT4EeM56WwNS/FTZQPz6ZKZBfFjkJnkZ:AT4ESPNOoPaKZJFOnQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
727cc9e64e828d78b30edadada3bbc82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
advapi32
CryptAcquireContextW
shell32
ShellExecuteA
msvcp140
?_Xbad_function_call@std@@YAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__sys_errlist
api-ms-win-crt-string-l1-1-0
wcsncmp
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-utility-l1-1-0
qsort
bcrypt
BCryptGenRandom
ws2_32
inet_pton
crypt32
CertOpenStore
Sections
.poxui Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 15.9MB - Virtual size: 15.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ