HaemolacriaLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HaemolacriaLoader.exe
Size

25KB
MD5

523cfc8e9f9217f5b298dd4ddacb5892
SHA1

d7da3f65767af5a0713df04ed3e1628550ffb006
SHA256

392c0157089d3b76c1e3a8b37db8c4f8a9397936e49ff4f2bbba045bda9d6e04
SHA512

6a269a92342e6861e661c958d1087de8530610bfb40856c7d3afe49724536ff25716ec88e89e36bbaf401d7690438393936b8c6bd2d35268ee034979d132bb4d
SSDEEP

384:0uTTz0igBqDMBPJBQCLJCWr8pJ944n3d6QtXiR/buVgqKgoPxAN7rB:0uiBv9gCLp8pHl3nXquVgI1N7rB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HaemolacriaLoader.exe

Files

HaemolacriaLoader.exe
.exe windows:5 windows x86 arch:x86

7b81eb5cab7c0894bbbc56cbf8493a8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ACER\Downloads\Haemolacria-master\HaemolacriaLoader\Release\HaemolacriaLoader.pdb

Imports

kernel32

GetModuleFileNameW
WaitForSingleObject
CreateFileW
GetFileAttributesW
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
WriteFile
WriteConsoleW
GetProcAddress
VirtualAllocEx
ExitProcess
GetProcessHeap
GetModuleHandleW
CopyFileW
GetConsoleWindow
CreateRemoteThread
lstrcmpW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStdHandle
SetLastError
HeapAlloc
WriteProcessMemory
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

wsprintfW
MessageBoxW
ShowWindow

advapi32

RegSetValueExW
RegCreateKeyW
RegCloseKey

vcruntime140

_except_handler4_common
memset

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_register_onexit_function
_c_exit
_crt_atexit
_controlfp_s
terminate
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm
_cexit
__p___argv
_seh_filter_exe
__p___argc
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b81eb5cab7c0894bbbc56cbf8493a8a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 900B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 484B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 900B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 484B