C:\Users\ACER\Downloads\Haemolacria\HaemolacriaLoader\x64\Debug\HaemolacriaLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
HaemolacriaLoader.exe
Resource
win7-20240903-en
General
-
Target
HaemolacriaLoader.exe
-
Size
29KB
-
MD5
6fe45765d5d41bf20ff0556e76ea08ff
-
SHA1
06dbf5451b0afc9a01b3a35eca91f80e60772169
-
SHA256
d560bd6208bd5e22962c0120db2f3bd7a58d95bebeeb9864b8b00e2b47871c08
-
SHA512
ad56d306cf781810b1967387d3e8eb13bd2b3fc55a87e87b400c28cebc22ecf400b13d47ac1499a2effa98654fd8472d82dba419e3ca71e52970351d463300ad
-
SSDEEP
192:6R4CE93odhV7ca7H9fmSO70ydGPgFIKm7EVN8VyRw7s7MrEht1l6aIj+KA:jNo3f7dfLyPiKOyRw7sZbl6aIj+K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HaemolacriaLoader.exe
Files
-
HaemolacriaLoader.exe.exe windows:5 windows x64 arch:x64
9a160a99647d3c4c9d8f4b0344630cc1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
OpenProcess
ExitProcess
CreateRemoteThread
GetExitCodeThread
GetLastError
SetLastError
WriteProcessMemory
SuspendThread
ResumeThread
WaitForSingleObject
Sleep
GetStdHandle
GetProcessHeap
CloseHandle
lstrcmpW
GetModuleFileNameW
GetModuleHandleW
CreateFileW
GetFileAttributesW
CopyFileW
WriteConsoleW
GetConsoleWindow
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapAlloc
VirtualAllocEx
WriteFile
GetProcAddress
user32
ShowWindow
wsprintfW
MessageBoxW
advapi32
RegCreateKeyW
RegSetValueExW
RegCloseKey
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ