C:\Users\ACER\Downloads\Haemolacria\HaemolacriaLoader\x64\Debug\HaemolacriaLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
HaemolacriaLoader.exe
Resource
win7-20240903-en
General
-
Target
HaemolacriaLoader.exe
-
Size
29KB
-
MD5
41339f0f8b7b83ed8498579668916735
-
SHA1
e70c4f76f30fe8171b2a628ee2206eefa175cdf2
-
SHA256
8992d9b4a5a17cea75773dec849fac25a72b79f56da34da31d4b1dab098f4db7
-
SHA512
3e9cd701ab7b9a12e455f38421aa0b7487d39ca07e838328f3801307ce17ab5919e730a533bed22f0f3371ee07bec9f45d722d28c66cfa526ba67225814ffdb9
-
SSDEEP
384:xNoGfrS3p/RZqROUpVyRw7XZbl6aIj+K:xNolp/r04HaIX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HaemolacriaLoader.exe
Files
-
HaemolacriaLoader.exe.exe windows:5 windows x64 arch:x64
9a160a99647d3c4c9d8f4b0344630cc1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
OpenProcess
ExitProcess
CreateRemoteThread
GetExitCodeThread
GetLastError
SetLastError
WriteProcessMemory
SuspendThread
ResumeThread
WaitForSingleObject
Sleep
GetStdHandle
GetProcessHeap
CloseHandle
lstrcmpW
GetModuleFileNameW
GetModuleHandleW
CreateFileW
GetFileAttributesW
CopyFileW
WriteConsoleW
GetConsoleWindow
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapAlloc
VirtualAllocEx
WriteFile
GetProcAddress
user32
ShowWindow
wsprintfW
MessageBoxW
advapi32
RegCreateKeyW
RegSetValueExW
RegCloseKey
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ