�)g��pBcL}���J{ʢ~�g�`��{��܉����p���I�D̯|�e��O�P��C�FW�i����FӒG%���m˪;)w�~��Wq��܌����T"�q�N3�[��;���0�bY�裚15�q����~��������gi�lr�0zBN=��M3��r��{�}rR��}_����ӫ��O"��B┯�t�7lt�/�\:6a=%�/�Nbp���cp����z�WP2@��GQ��ǹ6Db��W���Ι�� ރޞ���e�c��#�@^C�$�Ge�+�mz����P�=�bf�p�B�' aB4�2/e]���Ya �"{���vC�H)�0[�^9��R �=�' �bi�~�L#�On{�ŵw��=B})� Dqm�5W�7�u��{"h�l�e�s�,Rwk���M�� jjX>�H@��'y����xD"�9ֆ ����HŪ�s���4���VQ?��I�s��F�a|B���>�&�����q�ͦ� ����7��9:�����}k�HRٸ��"����*O W���:��^��ý�0OQ53sW{>�Y6N ��dC����ܮ��vm��l����<���nªݴ����$�J!K׀9���R�_�B�M�Ԡ[$#�j ]�=P{A}�����]�J������ZQ�N�?��Cه~b�&���ƃ�nkġ_��;���(� �rS��|f����r�B|��� #���v��RGK��������>� �d�(�M��-4$2E�ʮ&bo-1�0��B�x���o7�O惮�S,�k}�v��8��M��o��Q:�H���GA��a{iOhs<�mi�zږ��6�:�Q�M�� M���L�&^ϞR���SK����yI\sƞ0�T����,U�Fp�o�4�/��"�gv>�t��W��`N�/|��U� G�u�}�jV���0��uѺ�D՝8$$9Vf��"Wt����4Ve$��m���W[vO�p)��a��@hv�P2����?�J�#��<���c�<�M���!ܥ��X�Fi��&G�* �>;��*Y{%�ȵ!Fvsc�a2_������&VM��>�/�<Qv�u����J�|�Ip���ɤ59�����'�.±��p��gDsnR!`��sI�5�.�0E ]Uu���ب����1�6�9�L�3�k�����!+KciڲVNd_]�����+k���k}�^�l��`i�L�x�J���ȵĀZa7�cEu%f���ȓ�]����Sξ����.�5k] Hh�͡9��?�c��d�C!a)|T��.��2�9���� 7%y�_w6���9���=T-�T��F��$���ZkW�ES>�������=c�?r~<ʏwOH%̛�.���{�?�~��7���,!/l�OXG���Ah��{��E)���[R����KM���?����N���~�w��J@�������m�Hׁ� q��X�]�~j�ml��o�������&%a<L:^�>��³���jW���)7_6wӖ��Th�X���sW[�=8@�6�16�O��E��*SJcQ�|�l��W;�B�wA�ja0�<bt^s���b����G��$���ޯ(����7�+/��&=I W�}M��I2ڟ��U����tW��8����ѬB��A��>��k�Uqo�ُ#�;�Sߺw7��YE�o��i'�����%ћ�<`[pƍ�}�m8Xek;�k����r&����+�v0\u�ӷL�Pv�ui��o6�߉����j�]{�v#'�ql�~��ă�Nj-n�2�{+��ȼ�v�6.}�>b ���B����7���l?z�x�� ��W�o�zZ;7`��8�Recq��[E��a�ɫ=;��ji����e��/ƛs��*¨��eat���24��y��Iڟ�bR{|h��^�2ܽ�9�S�2>Tx;;)���ɵc��� �q�����q^A�@�4Y��_�鵰+{]��%�,�>Ϡ�ꗉ��[VoQ�w9��F�'���ҦY<��f�d����%e������Hl�A(K \fl�+�1u\z�,;�̉�������RPW��ֺ��%L=�90��b��V�D����ω�&Ϙ�<��"��+ @q+�TBi�S��.JD\� S�`��P��(��{w��E-W���@{��4T�4� uɨP)�-,�van�ꍂ���+�p ��d�����3��˒',m�y�p�(%���!�������*E9w�'@�P�R͠ߎe��f����{����}_������p�A�șX���A����p�#ԥ� �T�}�#�꽌{��_ۣ�����AT�d#�a7OBD�+R��ݲF^�8�n��?&�m��WJ�4b!V�Q0�0$�)Q�gf,�Xtic��w�rC\���e��gG���'�e<L ����qK��k���Ѩ�w�GqlW:o�:/�j[+���x���:�ʶ^1����`Mf����t�j��H����u��ј��&��T�����C�Bޡ}��g`b��*���e;����n=c�g�HY�8x���-��G�%��K����f]g��*Ԫi�7l��s"�������#J�1J*�j�ˆ�^ho��t(D���&o����u�H�=�7��\F��j~���E���q�5# �g��<84r�e��~M���E�5��7���q��9~��;<���]�M&�����}��d� p��6��֢�-4٪�����lֆ�ߋ8n��CNY��_��A��g=u�X�9$��b 4�:����3���h�(zxӼN�N#�3��4�;LN��^�n��:5����ȩ��Bpp�&3��l�gTk��pT}�z�� ��5�g�I|臄g�I{&���W�DT#���zٵ��G���[�^�>����w�Լ�������4|�^�e���W�,�<��ةE T���_%tr]��:]��Ԉ�Ϡ:E�&���*q�X�i�Ƒ��"�oU���1�̞��R�x�}R{�\G7 8� �ўċ]��� �h�r/{V�n�=XyS�VAU@�,t������4UϘ �Le7fu�r]�}�:�KV��<{R�k��t�-xHWn��o������e�M_-��S�%��J��ڦ? O��Sz:M��i�����EW��T1�h�A��#��[o~F�,>8�m�G���s�;s\ �Cx� ���L���x%C|6���?���R�d��k-�J��ΐ�UY%��$8HD��րQP�<��N�J�ʺ}ӗ�=�A�w�������[pYd%Ϭyn�Eu���W�㎓j���! 2��in#�T�S����La�)��]=�V4��B2|��*f)�%u�#�8�j�"�QP��~4�L6��*E7�|�Ѧ�Ht�ugȞ!�'ᛊ$kmQ��$\"�5�<�n�՝�K��W���b�uc�W.�n���424Z�F�z����5��G-����UbA���0k��㏓�{E��%��.��)a�@BPX���Cيzz�Ɵ��M���V��sL������7hU�h��%�6���j�?2[�k����h!a�"��Ќ/1�'���?���/�[V��-�0�d� �W�M��D��?n��}6`P�ꔣ��gU��c���tZ�Cf��tR7��)�-� �>��g�+:�:���L\�eM�Fp���e�������� �M��g����H� ��Yu���|N��7RJ�*�/7�k`m�"R��}�����a� ��Bwu�|w|�Q�j0������GX!,��
Static task
static1
General
-
Target
loader.exe
-
Size
8.7MB
-
MD5
8571683b97174586b0559ade05e786a5
-
SHA1
ad4a1cb95db584baa4b324f7552251db0d7bc7d4
-
SHA256
5288eac757e923868940245fb60edbc87672111f04b03429afd1f98a4765a36c
-
SHA512
3b2c862a72c1f4b30d929c9d5bd0028a3de7c86f47f1ef9ed392359e4a6e6179594a3fe0d4ed6e44d83e6929d9e36e2786ce658eb49e01f165d56ef0e86fb0e1
-
SSDEEP
196608:kh2ihblwux371zZm4MTnLZ9RT1ItwRB/SGXjfz2Oa4fNYe/wwx:+j2ux3hzZmvLZ9RT1RRLDq8Ye/F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 409KB - Virtual size: 828KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 91KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 957KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 31.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE