LoaderChams Normal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LoaderChams Normal.exe
Size

3.1MB
MD5

8094c31ee72eb7bdae1a1131d5bd834a
SHA1

ffcd519b678e074654755f151254339ad594b52e
SHA256

74299d37b4f08188f36034039b07d6c61a434470416d138987bbf283070f648e
SHA512

7b0db63880917a6734f2b05c9ed7e50ae24d49bdeecfb45bae8f8c2a564fb6595604c3e10569a5696a441563b2c3ef54830a7665efd547d4502e832edc694799
SSDEEP

98304:YkFfHly83eFsYvPItEZyYyS28gbL3sx1FIbC:YkRH1OFHvPIe72FL3sa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LoaderChams Normal.exe

Files

LoaderChams Normal.exe
.exe windows:6 windows x64 arch:x64

0ce0e896b6a04da8afe27a902d89872e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

QueryFullProcessImageNameW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWinEventHook

msvcp140

_Query_perf_frequency

crypt32

CertEnumCertificatesInStore

normaliz

IdnToAscii

wldap32

ord211

ws2_32

select

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA

httpapi

HttpCreateRequestQueue

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-runtime-l1-1-0

strerror

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

SetSecurityInfo

shell32

ShellExecuteA

Sections

.text
Size: - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ce0e896b6a04da8afe27a902d89872e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

crypt32

normaliz

wldap32

ws2_32

shlwapi

rpcrt4

httpapi

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

advapi32

shell32

Sections

.text Size: - Virtual size: 491KB

.rdata Size: - Virtual size: 117KB

.data Size: - Virtual size: 151KB

.pdata Size: - Virtual size: 19KB

Size: - Virtual size: 1.9MB

Size: 5KB - Virtual size: 4KB

Size: 3.1MB - Virtual size: 3.1MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 491KB

.rdata
Size: - Virtual size: 117KB

.data
Size: - Virtual size: 151KB

.pdata
Size: - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 480B