Loader[.]zip | Triage

Resubmissions

30/09/2024, 05:05

240930-frb34ayhqn 10

30/09/2024, 05:01

240930-fnsxfaygrp 10

Sharing

Copy URL Twitter E-mail

General

Target

Loader.zip
Size

348KB
MD5

0b8d97bdb6fb44d9e51149644e290576
SHA1

13a8e579ecb7e5027071552e1163715b010c1083
SHA256

0fc15be18195d6100db052e76ff0f9795bbccce0657e1086bbda2fc8ee1550f1
SHA512

f33bc882c631015c7a881ffe9d885a57d3ae95b9f01a18feac92fcc0b98356d007cf4cdc5bb597ba36bc1387605aaf482f6686913fef51bd5c02e335c4d954f8
SSDEEP

6144:7mlwqPcYamkhzmmgSvAULpkfVsDv1PPF8mXLzipfJUxG0U:7+Jk9LgSvAULif6r1HlLzG0U

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader/likodi/NotificationController.dll.mui
unpack001/Loader/loader.exe
unpack001/Loader/wdi.dll

Files

Loader.zip
.zip
Loader/dmxmlhelputils.dll
Loader/likodi/NotificationController.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Loader/likodi/SmiEngine.dll.mui
Loader/likodi/netid.dll.mui
Loader/likodi/wfascim.dll.mui
Loader/loader.exe
.exe windows:5 windows x86 arch:x86

bf5a4aa99e5b160f8521cadd6bfe73b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Imports

kernel32

RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

ole32

OleInitialize

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Loader/mqutil.dll.mui
Loader/samlib.dll
Loader/wdi.dll
.dll windows:10 windows x86 arch:x86

d2c5ad65de7676505e640af8a127b32b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wdi.pdb

Imports

msvcrt

_except_handler4_common
memcpy
memcmp
_amsg_exit
_XcptFilter
free
_callnewh
_vsnwprintf
malloc
_wcsicmp
swscanf_s
wcsrchr
_initterm
memset

ntdll

EtwEventEnabled
EtwEventUnregister
EtwEventRegister
NtSetInformationThread
NtQueryInformationThread
NtAlpcConnectPort
RtlInitUnicodeString
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtAlpcSendWaitReceivePort
AlpcInitializeMessageAttribute
EtwEventWrite
TpReleaseAlpcCompletion
EtwEventActivityIdControl
NtAlpcImpersonateClientOfPort
NtQueryInformationProcess
AlpcMaxAllowedMessageLength
TpWaitForAlpcCompletion
NtAlpcQueryInformation
NtAlpcDisconnectPort
RtlNtStatusToDosError
AlpcGetMessageAttribute
TpAllocAlpcCompletion

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
SetEvent
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
CreateEventW
WaitForMultipleObjectsEx
ResetEvent
LeaveCriticalSection

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-1-0

CreateFileW
CreateDirectoryW
CompareFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
CreateThread
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

GetLengthSid
IsValidSid
CreateWellKnownSid
CopySid
RevertToSelf

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
FreeLibraryAndExitThread

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernelbase

WTSGetServiceSessionId

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ServiceMain
WdiAddFileToInstance
WdiAddParameter
WdiCancel
WdiCloseInstance
WdiCreateInstance
WdiDeleteQueuedResolution
WdiDiagnose
WdiGetClientActivityId
WdiGetClientLCID
WdiGetDiagnosticModuleId
WdiGetEvent
WdiGetInstanceFilePath
WdiGetInstanceId
WdiGetLoggerSnapshotPath
WdiGetParameterByIndex
WdiGetParameterByName
WdiGetParameterCount
WdiGetParameterData
WdiGetParameterDataLength
WdiGetParameterDiagnosticModuleId
WdiGetParameterFlags
WdiGetParameterName
WdiGetProgress
WdiGetQueuedResolutionAudience
WdiGetQueuedResolutionExpirationDate
WdiGetQueuedResolutionId
WdiGetQueuedResolutionName
WdiGetQueuedResolutionPriority
WdiGetResult
WdiGetScenarioIcon
WdiGetScenarioInfo
WdiGetScenarioInstanceCreatedDate
WdiGetScenarioInstanceFilePath
WdiGetScenarioInstanceId
WdiGetScenarioInstances
WdiGetScenarioSourceName
WdiGetScenarioTypeName
WdiImpersonateClient
WdiIsQueuedResolutionAdmin
WdiLaunchQueuedResolution
WdiOpenInstance
WdiQueueCurrentResolution
WdiResolve
WdiRevertToSelf
WdiSetFeedback
WdiSetProblemDetectionResult
WdiSetProgress
WdiSetResolution
WdipLaunchLocalHost
WdipLaunchRunDLLUserHost

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 176B

.rsrc Size: 3KB - Virtual size: 4KB

bf5a4aa99e5b160f8521cadd6bfe73b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

Sections

.text Size: 102KB - Virtual size: 101KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 218KB - Virtual size: 218KB

d2c5ad65de7676505e640af8a127b32b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

kernelbase

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 176B

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 102KB - Virtual size: 101KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 218KB - Virtual size: 218KB

.text
Size: 73KB - Virtual size: 72KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB