tl�PeFe���uG�\k��+�'ic��v��+���4r]Ҽ�9�3���5u:��<�9k݇4�KG#��π��`?�G��T��/m�y���~ �f6��Yܲ�/���e,���(��]?�C��������&�_A�QW�Я V��@2c�xȟN��6�m����2K�4yN����(�C��uս���[�M�w�O��Š���`َm%�����.� iCQ�X|��`e���= ��<��7�(�~�"v]9, 0�,�*���O��9���fa5�E�!8�\��j�#�Ex{;a��}afJ��cl�O ��R��,��{��>x�� �h�'VL�6��n���T��Bbĺ΅�Z]���O��/���=�ŌC�<:�+ Y����o�A�p˵M�)P[qPhh�ܪ�"��M�]|����PE��1����xSk����v7�����+)��Tiއqql��u��`�����9Tj��}�<���6�X3�cü�Լ4�X�n� @�~��A7�a�c`Dz�O0��YC�ƫ������f�sB���{��aZ�N�����R�W�\dO���.:О�� !/��}��q���%�.�Ոٵ�Ȼ��ׄ���M�_������Qm���r)��T{yN���<6�x�K>22����?yG�x�����(�,=_�ƌK`hls�r��ǝ"efN�2���:�S!`Ȱ� ss����1��!!�ru���뾞d��hD#�@� ��r�!G�n���q�W � Η��Ÿ�?�Y�������|{�Ԅp<�BɶL7�j%V��Wp��� ��3��6 T�g��|9���%0XU��9@�>/�����Sc���З���nv`k���O���A��noN13�1|=���I�� ��nL<J�\G��8��TW��-��Wug���2o$� �=��ζ+qd�Jq �Z�Rv <���-sLuv"jX�N�(1�.��>�{�ҳj�Iw�f����gP����Z\n�Zhn�ۖ���������Y�ߠ����"����w8����ԓ"'���Y�bfp�..�,T�r��j���� ��W���u~B��B�YsU�=�ۗ��O���0C�=W<��Gv���x(��|��N�o��YS���f�A�ڮx��5q�5̧!ޝw^~*M`��Q U� 3>���@�BA`�{���9ϟ[#���t��:����D� X@��F����ř=r�>ȫ�!��9�L�#�%���{�f�Z`C���"��\~6�w_e��40i�U���Ҟ~A��W����ہ����-�u?E?�AGj��bg�)q�G�!��#XO���o�|��Ѹ;{�>��#rE�D����끟�⦂�� /P�F�"�2@90�Ah)� @HeZ����)/B^ r����%U+�Qx���&��h�������� �"X��BlƄ��J�D�η�^����}��껷���d����G܉i��O�ұ�U��{f؊�ͣ�̃�����t�q\�d�~���!?W!��� �A��� ����ڪ�,!�N�Ƚq�<uף7��S¶-�Q[h#lLDmT�!��&�����E����=�\�Q�D� �0�+��=!&s�o��$����Bؕ��E�Q��G<�i�K�Z��G�}�dBV�h�U�&G�' �( ��\-1Q�`2�'��\�R���\�#:`늊��2�p1�3�|K]=�֡T4��&J-�&C��N��uN�}��EH�]H�Jz���e�e)����v�L������M�n#�)S�}˃�i�=��oh�����9��>$I�y��%�S2��T}j���۸b�梘RbQtw������&V:��!G�9���V!$"W�1�dy�:��}45�Z�uo�l������$� 3,k&��\��*�v�i��ܧ��s�7��li���Hݷzl�X5y��m�PR[��]���1�j��@.��.0��������ڝ��i����Z�{!���B�^F��/�m�Ľj<�`GR�R�� |��Y�U�;0����ȥ��xW��o4��im��&�k���<��j���t�%S�d���uW��n���gS���|u�@R�-rG ���h#��������~0�m��y��^v�|쳔_�}\��4*��b@�Z��)k�&8��GL�:%��e��n��i�Wu��0?]~��#h��9N���^��bj�p�5OpX� �����0��'U��������Ľh���'d��)���W����Pˊl�R"��n�P���o��}A54�.j�2[�|�4��r*Mgn���D|����������Tɪ�;�a��%в��g�n$��2�Z[�3��ȹ���~ma��Ѹ�pG�Wʿ�\��94�ٙ���0�D������$!�7kz֠Z��HQ}���-CcP ����%r��U|5IF�'G�aMݍ�{}2��B{�{���d�l���g����=������b�[�\�,]��x,Rk-׃hgK����BD�?��)z��$���r�LD��<���rC������/�r�%� e��^���X�>lO�Y��P`#Cx%�_�j�w6.���Y��`�d��/����j���e�kMўh�������vG���`�g����U��a�5l|�|dy�?BS�RZ���!���"�!]�$�MGt���E pgw�N!�b�ߚ�8ih +�h��"�fvZ��]#S�{�1����{6�=��j�gGE)��累�Y=W�&��BHo�Ͽ�Wթ��y!$7�B��yn°3I���p����L��`�R�<�i���y�-V����a~3#�����`p��d�_�����DC�e�s�U�������0lK/ձ:E����f��k��y9�߁B��N_���d2c������䜣�-87�Q��0%��n�k�c˸Z����s���*��Z��XA��r���#X�q`�l�[дM�.��cgL�+p�C=��F W����f|����֭;9�L�l��[ͧF�Y=��[�U�T`V�%�|\��q��DW�\Lh=�{�������8D��*d&;��_!}��)`Ri#�k4R��zB�j�^�k���3�ܯkE^7��9'~�\�roh�*����÷��u�tD���S@!?�=����E�ә�ߋ��g ׇ'��^Ր��#�Q��$��H9��լ�@~c\��<�1~� ��X�|d�샵�����������u ��8�f�=�����=Z�f��vY�֭ 2`Z(q5� M�6�?����)4��x����l��^Ƣ�aH���Ę��k/�8!���kW�q���]���Йa�r�Zā�Fk@Y�~wS|o]������<�"�����Yg��"-t짃�˂�s��I.!��p�NJ���K���"V-��[�!gœj>H#�r���s���T �\��leQ2b�����߫Se��|�j㑉�_WD�brs�;�sYB����UE�JIt*]�r�Sh�(uқ:U/��{��w�#H�������BFU��}�S��U�;`�P�R\�IY7��Kv�`�]�O��p�-H�x����k��l��a�����'�.N���n�,N���ғ���Ɩ����:s�s�`��c�e;�e�"q����7zj�ry�,���g��3������Y��Xi0��s��@�d�9sF��;`�:�C�rh.&9:]��S�dCL��
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20241007-en
General
-
Target
Loader.exe
-
Size
7.1MB
-
MD5
ce364a00ab35ae992f9359134ea98d24
-
SHA1
b4c39e9a3d0e301f4c89c564076784c5d4ddeb2e
-
SHA256
c709670017b9be6c882dc6ceb7248b82f2cb00f1bb0842462368de3561cb03ca
-
SHA512
548e390d66e58ebb2e60b08bfc82f7f30561ef06d6703c318d30f570f6c4b660d090ade6a58d03ee3f53809e046db63f9eb6f81146c3240eafb8c77bbe740af9
-
SSDEEP
196608:vKIbRNzCJJ17xm4skRAc8yAm+nTAbxN+OI:PbRNz+J17xm4MeAm+nTaxN+L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 80KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.2MB - Virtual size: 244.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 268KB - Virtual size: 10.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE