Static task
static1
General
-
Target
loader.exe
-
Size
49.9MB
-
MD5
80dfe09efaff36e39eded295968ef317
-
SHA1
34bafff714233fe388cb4454e50258c5545852fe
-
SHA256
4f17f785b4df27f12c804eaf4e34785795676413be147421b8e6c18457f459eb
-
SHA512
e458416f61b0ae8b51faade56c09d401ab90fce61c016943af019189859802ddaccf3f71061f4e95d36d2bb58f31c4acd9e7876f9d61247ce0f424c0b101f81d
-
SSDEEP
786432:LAEc1vH7p5b+nyz5HZ7OJgf4g4SENYpLTUH+kuJRLJz/KEbvp15exb1FeSnFiXm7:LAEcJz5kJgf43S9u+kK71yiSFi2SA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
f4b4c8c89e3a10f9e184be70eceab899
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
DefWindowProcW
gdi32
GetDeviceCaps
advapi32
RegSetValueExA
shell32
ShellExecuteExA
ole32
CoInitializeSecurity
oleaut32
VariantClear
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmGetContext
d3d9
Direct3DCreate9
ntdll
NtClose
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-stdio-l1-1-0
fputwc
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
abs
api-ms-win-crt-math-l1-1-0
ldexp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
remove
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.j2V Size: - Virtual size: 30.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.U'e Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.%!{ Size: 49.9MB - Virtual size: 49.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ