20241001245bac5c1fa9cc473b6e76b4836bfe4favoslockerhijackloader | Triage

Sharing

General

Target

20241001245bac5c1fa9cc473b6e76b4836bfe4favoslockerhijackloader
Size

5.7MB
MD5

245bac5c1fa9cc473b6e76b4836bfe4f
SHA1

7794f9d32ba675be661fb78c70e1ab7149eeab18
SHA256

2ef3d4da1131b0d083b57ebaf81673f5711a1b8c3657cc8b0e9f4066d2b273da
SHA512

97742eae20586bf8170067f56e3ba5d79f34f2a158f6c9f917efcd8f114aff625901e77ab907c9d57e97584fdfa87cd69132cddb63078628a8b2a0cbc4c6aaa7
SSDEEP

98304:/NAq7yUIhuaAkrMmCqNAq7yUIhuaAkrMmCBNAq7yUIhuaAkrMmClOU/jIEeQfoRS:/+KFaRj+KFaRg+KFaRyFIF0wu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20241001245bac5c1fa9cc473b6e76b4836bfe4favoslockerhijackloader

Files

20241001245bac5c1fa9cc473b6e76b4836bfe4favoslockerhijackloader
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

qiTa.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ