Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win11-20240802-en
Target
NewLoad3r.7z
Size
1.3MB
MD5
a3f6a5703ae7bb7cfde5037a918f02af
SHA1
7665099a5750b1ba006ac263fcdf8a5683004097
SHA256
dbe5d07e313b0563b22a3a7d1d4b9e2a13dec59dc63f7d51bdb140f5bbb74c3f
SHA512
a5dd2b270a2b38ec4488f6773864ae55592f413b325ad6146882da3f926dcdbf8ff2ca7cf60e8662698d9d6b3c57468c6e24465ec2859e57b16c51d861935112
SSDEEP
24576:lyoWaNtUK/VLRf344nK0Iedw0r1vwsmiljKa99RaAfZ0iblbebEpj9:p1tdD/44nK0Ie51vxmihKaZZ0iblpj9
Checks for missing Authenticode signature.
resource |
---|
unpack001/Loader.exe |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
AAD.Core.pdb
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlImageNtHeader
RtlFreeHeap
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
ZwQueryLicenseValue
RtlNtStatusToDosError
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
OpenSemaphoreW
WaitForSingleObject
CreateEventExW
ReleaseSemaphore
ResetEvent
CreateSemaphoreExW
DeleteCriticalSection
SetEvent
InitializeCriticalSectionEx
ReleaseMutex
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockShared
LeaveCriticalSection
AcquireSRWLockExclusive
RoOriginateError
RoOriginateErrorW
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DecodePointer
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetContextToken
CoGetObjectContext
CoGetApartmentType
CLSIDFromString
CoCreateInstance
CoTaskMemFree
ResolveLocaleName
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
RegOpenKeyExW
RegCloseKey
RegGetValueW
SetThreadStackGuarantee
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
LocalFree
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
CryptReleaseContext
?__abi_FailFast@@YAXXZ
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
??0Delegate@Platform@@QE$AAA@XZ
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
wcscat_s
wcsncpy_s
??3@YAXPEAX@Z
__CxxFrameHandler3
memcpy_s
memmove_s
wcsstr
vswprintf_s
_vscwprintf
??_V@YAXPEAX@Z
_purecall
time
__RTDynamicCast
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
__ExceptionPtrDestroy
__ExceptionPtrRethrow
__ExceptionPtrCurrentException
__ExceptionPtrCreate
?terminate@@YAXXZ
_wcsicmp
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
wcsrchr
?name@type_info@@QEBAPEBDXZ
__RTtypeid
wcschr
free
calloc
_ultoa_s
strncmp
_strlwr_s
malloc
swprintf_s
isalpha
isalnum
_wcslwr_s
wcspbrk
wcsnlen
iswspace
_time64
_gmtime64_s
wcsftime
__C_specific_handler
_vsnprintf
_wtoi
__ExceptionPtrCopyException
__ExceptionPtrAssign
__ExceptionPtrToBool
wcsncmp
srand
rand
_wcsupr_s
_wcsnicmp
_wcsicoll
wcscspn
wcsspn
_vsnwprintf
_vsnprintf_s
difftime
_wtol
??0exception@@QEAA@AEBQEBDH@Z
memset
wcslen
_CxxThrowException
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
_XcptFilter
_amsg_exit
_initterm
_errno
realloc
memmove
??8type_info@@QEBAHAEBV0@@Z
_callnewh
memcpy
__ExceptionPtrCopy
memcmp
??2@YAPEAX_KHPEBDH@Z
LsaLookupUserAccountType
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringLen
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsConcatString
WindowsIsStringEmpty
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
ResolveDelayLoadedAPI
DelayLoadFailureHook
SystemTimeToFileTime
DllCanUnloadNow
DllGetActivationFactory
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
C:\z9jsu3\obj\Release\Extractor.pdb
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ