�Nv(�����_�*�liL�X����x��f~9Z4'[y�Q���慍��d��p;��ҽM�T3�q~�G�ʻ��0��/�b������g�wu��� �����C X��$ ���w#��+��Ǩ�%�w��p�.�����"4��B���0��ᄘȍ�+�Hu�Cu������ɐ����DA��caH*�;d�ERԃ�у���O�@���3�HK:�E6�a��F��٘7��� ��ZeO=5~v���~脫�O�:0MW��dFq��i~_"��|�L=�����=�F���]چ>�H`D��|!U�v�z��]eF=+����TmB�b��X���Ug��=e'���v�{�l�0Rb��2��0vy�������'Z8� �99�;� ��9�%���hxi�ps�x��ss��S��anQԮn�Tg�a�/�>5G�U����J�H�h:!Kh�7{|���Z�(���'+�t���=%5�|ۺ�`�J|�]���������(�U8�y7;��_������Hf1���5��sd@����0q��R�:�b�5g�X����H�1w����`��O��5:p��hz��TY��'f-��ӟ�fk#e=��Q�ɇC/�*���U�� �.7��1�e��}��~��3��bӥRa����:-֔���y(ٻ6K���E-�Ii �.��Gc��_G�L*�zG[`�{���-b�B�c�m��?%�Ť�������j����$�J�(�������*���دW��,_G�5X�I��\MR���ֽ�������?+2b�� M��ĸ~��I�����4#�cbQ~R-a,+ x�ZR�����V3v���%<��t�d�t^� +<�'��E)�lDL7�c���ԧ:by$4�^���B��O��2rD��Ѣ=�>�;D�4�� F��1���3A fٓG}ɳ�i�r��>xE�5)����6Jz����g#�a�����1}.��DZ!?-|W�{��K,��88�=��f/Z�h�T��R�����p4?5z���$���k`o�g�M�Z\1|�`Ur�!sQ^X��2i�Ϟ��ARO����O/�..�Y�<�RӴ��V�$*?�+TR�4��ꕩ�����-<��P� 0���n/6��#�?ٿ(u���U�<Y���>��!����mи�J��L����p;I˖s��p��V��1x��D�`�-{2���FE_:3#F O?�/�EU��{J1(q�M��>x�'�y�����ף3��C ��\�c�ֶb\��Y���{�x�,�ʑ�rFɆ�7l��#��b'jS����h$�L+߄�脸:}�92\��S�O�k�/�g=t���,�&q)��j�B��1�����܈�#����釆O� �T��Ʀ�$����Y�I���f��#��� Q���z�G�:����6n��gp���0W����:�H�ބN �sn�s8X�X:�-ZV�獬�[���3ƅ<�A�j��J��`G��8�&1W6'��6�n�v���tt�us0q�x� ���b2�,w5\�����y߉?6��\�',a��'�D�Qa�8Y6�t,g^F�\�|v��l�h�*���&;�J{`���,z"D[�{�r%�.�8��H��l��a�ga��g^��᷵� yX�]�ņ��C��7�[* ���D|�vDG�GwX��?3{6��I��q�:�Q�k��FO��~�茜�r��¾X�'��[�� ����S|��1�)~��6�����[�� �2�̎/��,�-�D�r��.%B&8�j����l歖��v��8S�s�0~���H�90U�6`w��_ &�y8��W`�3p���Y������Y��z�NjЭBK�6���n-�͓f11WZ{<��Q��i����$�ᤜ�8��^�������������ċ���j��3��Ǎ���u1R��ry�LȄx%3�Ϯ�mʯ���G�� 50����U��R�c8�f����\�du��0Q�Ֆ���`��Bo"��83_F�u����|p_��Ԙ ,�K��(�K�c>�v�'8���H>�Aa���ަ9��K� V<H/\��L*լ5�\�)��q��I�:�E��5�X!#���rS����x�9[ܣSXp�-�kF�t?n"5Y��sҾ�A���K�m�pD��*��u��T��p��~z��Y6��x�X�|?�w꧉N��������`CB�,J�˴�j,z~��k�PC�P�I�C�#�!4$��YZ}[7*��JY� �4�QTg�3�T�k�p��X71H�&��;'R��,���)�-��H������y�/�~ծR1p�´�*i@��9�;2\�����_���X�7��K!繜?�QE�[�����R3�lfE�F4�|7�N볚�d�����Җ��0 ����1��<��gr��yOn�������A"JiN�vw�3�*��aQ,C�;��������7�J�p�}9��|���Gp������;�d���t��ݨP����Fb��b��T��n��&w�KK�g?J2K��TC�h��~���I�cs���F��ᝦ�U�BB��8r�xI�U�j�`%��/�7��m���1�1�a-���5TI%r�$9���g�J'E �S�S@�1S눕B��{M�E=��k0Kn�tm�K���*���`i�Q��Uk��+��Č�.�e���<%�h����Y�JV���r�[/��e*�I���?$�s�:���8��V�iꊯ�>��_ǿ�:|a�c�R��:��|8B�ĥ^��5{,���w��}���z����-*��Y�@|����&�K�Cb\�`���K;!6�;�L��v0-hCd,U �K�ʛ^�d� ��z��ߡ����wG���N�ĝ��v��f���L�̵����Hu�f,�Jw�)���D��z(�<�*N�A(:��;o�̙Ydc�f���������i�l�*�0���n�E.m��17���%�����:�>.��6�i'�����)�y��=�۫Z���"��� 38��+cq�%��Z2��NR��n]c�6���j~�u��'�҅Y
Static task
static1
Behavioral task
behavioral1
Sample
Venetra Loader.exe
Resource
win10v2004-20240802-en
General
-
Target
Venetra Loader.exe
-
Size
8.8MB
-
MD5
134490de1031ef65103faf4541444dd9
-
SHA1
c093abb29e5c8782711346fec00e5b5ce1e5a252
-
SHA256
bc2193fdf9deb4a281f02724ba32c3d56a24a07a6b8ef7f413edec4271e32320
-
SHA512
2d6a40c406ef300a2dd07035f117eca50f3e2aa5ca3f49dd4201cc424e096d14fe0f16badcddad96ba0e33e7397a78da356ae219b07329f2062d5f5ee186514d
-
SSDEEP
196608:Fk1C8Et3IQiVAr7velZMFOlZKL+P4gN7TVqgcneX4fRgAo:F2CCVAHveZ3ZK+4OQgIeX4fRg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Venetra Loader.exe
Files
-
Venetra Loader.exe.exe windows:6 windows x64 arch:x64
c285c96b2d7797da59e032af3686ddd4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateRemoteThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowLongW
CharUpperBuffW
gdi32
LineTo
advapi32
RegOpenKeyExW
shell32
ShellExecuteA
msvcp140
?fail@ios_base@std@@QEBA_NXZ
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
shlwapi
StrCmpIW
wininet
InternetCloseHandle
iphlpapi
GetAdaptersInfo
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
psapi
GetModuleInformation
ntdll
RtlAdjustPrivilege
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertGetCertificateChain
ws2_32
setsockopt
rpcrt4
RpcStringFreeA
winhttp
WinHttpOpenRequest
userenv
UnloadUserProfile
vcruntime140
strstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tft Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUQ Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.*O$ Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ