��MXI%��O���G�L��&�R���%��������2Z�A��/��ךc#�bi���y���Ƴ�fr}�-�@�%��y�|��DRSHD���t:�i8�Zu�}6�K�t��1�R�}!���Mz��,DžB��xW[�*����< ����Y%�{ȷ��$���)��z-%</L�����b����ϐ���q���p?L\`�V��8A�H��<X�#��q�8B�(��D��z��"��w9���4���k�J�^�4 ~8��q��z��%W�rg�pȄ�Nq����F�i�����"~�L��T�%�X]����b�|�>�~���ڵ�*r�a�{!U��A#Ϭ�*�2�s#����cX���F�z� ��>�^Î�7��ʅ��MLL������W�o����7�_W$�Y_3"�;�}����!��^���p���>L�-��4OFt���YH�nr�#0�5�]�n������xܥz���%� ����_�:�]_U\A27����@mU&]/��B�H|i�� �" l�:�� 1/N�X��A#2�!ba3�-Z*�q��~�.52�� p/`´|eΧ�J�$��֍ ���^�ť(�ۯ��g9-���0X1ms7�-BP) ���_�«���U����58����X4�M����s���dz_ؽ�[ҿ�e��sGp�C(�Ƃh{�~�ʣ��='�ǙY�M�L6�n[TȨ�*4v��[��:V�Y��͎χ�X����N?>o��{���ZȨ�����u����KJ<�)}��&�T�ۣ�K���v�2�dm������^L+<U^�<, 6ʷ"�֪al1#q�����7�>�6������B�*~�;�ث^)��X��F�O����LK�Îs����,��������[W�>㏡, '�������Y�-����ܲ�g�Z~b�c���z�9$�K��9W�~q�σ宅r�����u5�~�� ��n�:苤��_p1"?8?~yt�ޘѡ�Zܙ�^s���,��nk�YT-������,�����=&I�OO3z�K�/���{� ���!k�;t���b1#:T,#����X!U@.���=��S-5V5��붏���?��� u:������2M=|���o����b�|���s��jS��5�]�Tbg$2"�eC->K�-xw�\���|ݯʡY��G�^�?:�t�&qy6���Y}�:ܷ��PN��>��h�;�d�V[���g�Q�~�����@���\���w٧�}��t'��L��P��H�Vr��bw��w��A�{��HN�֖'��zp������\ �M�C�<��p��b���R�e=�H.���B�ƌ�VY<����g��&L����(��F>s���k|!2�����h�)��d�g�ߕB���&�lԬ���������vy�ŗy�~hlOu &= ���5��0�Vw�-�@˛>3������bc��)E� ���q��](��6�-c�\4�ޞ�P8Y_��^)�&�rC P��P�P�ٽ��U�d����X�.s( ��E(��\��{� �|�<L�1;����̭�r�mx�̡�V1�H��M�P�(ֱu�"}[��~�bln��d:�������"�4)i�H^�/��ږ|"=Wj��tb�8zJH8Tv�AYZ?�Z�U��&��!M�z���~� ��[�&ҙ�Y���x�����w��X��Sز�L,��}��c�b9w��b��Sۂ���Jm���@������3�AsN)XB@l3~t"[僚֡�Wb�|���A������� `�w������3Z��]�/V����V y��/�\V����ߊBr�q��o��_��+.B��A�#a�����nf��ρ��k�f�#���hm�L���V��+���L?��H�0�B??_�DG�Zu���,�!�`$��`amF(ܝ���O���9�� ��)Ʌ�X?+U�N9m�)7��{M䶅m��+����Kp1b�<86��������Ũ��M닒�>���,�1|���d�qt�y ��������,�ړ�}��^U:�� ������X���#]�#1�/����桉�*j���9�u&V�*( :.�?MK�؏n�&�!2y��@��.�Y���|�`�\����7;`��y�F�,�j�%���J0 #�1� k�t�%k�KA0�%!ނ �W�r�*C=86D��Q���[I˭�j8�'BB;dz_���e$��ǜ��.iMHo�4s�vGܺ�̈́���ҩ��r[/�D �unub;#�ɱ�����Sܔ'V��҈/�UE�3-���/榹��|>��$�� �S����]r �Ęj���Iw��H�OCE(uO�i>6�����D��h�~,��&��kGdH�4��^9�y�d�O ��ӤG�*�[h�dB@0���4ͷ����6�P���(bV���`�#o}s�2[�p�jߩ�����i�K˨ח�['����I*?'�ݚ}`H<'�77�\�����Gh�7����#8- Keh�B5Wʀ96(�g%���<��(H���ř�g-Hg�H`�=�z�� q͑����r��5� �к%?)�j�-Z{{>�SxoV��杹5�Qt�W��x��wbܕ�ź3��H]���"�_��M|�+�Z�$�qM�G� �)L���q�z��=�$���y~k��-b(?���f��xi��Y�_E�����i@�6���]Z"k� ����ۮc�_������6���8,�gUz����k��G9t��L��v�^�+��i�y��{�g�( ���J1uyo��p��}�r@듣 4���]ˍx�8}4���i �_�� �#�]��4M�Hb8��4����ˍ=uLO��I֣eU%����{ ҽ�t'>N��@� ța�������9��$�\��]%c���&p�����TV܃�)y^Ag;������gW�v���|FH<�f��.���|�_kܬX'�e�����;���IM!������`Av�K^�{�˫ }�-�I�a��b��g��jz�@$��h�
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20241007-en
General
-
Target
loader.exe
-
Size
5.5MB
-
MD5
b9883406376e80d1bf379a3bf6728525
-
SHA1
1103dfe1876358e10e3dc31a7d2dac39563b5796
-
SHA256
819e72afc36e191e701c04dac71ba3a00be245bc39ef9ed778ee56af698aff9e
-
SHA512
9ff0f85f6f3a4e710fb54abf46cd2e1c5d9282278d2b32ed69eaf6040fd38772bfdd492535e0cc6ddc1c79a0a9112e4e1f8edb761e51c00fb46dea379b92cafc
-
SSDEEP
98304:ezflpX+SGrYLU/3kZ3riE+5rA0oo/IdU+7uBJhJ23eZwSL77QlEg:ezrAIfZb/irAvjS/lZv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource loader.exe
Files
-
loader.exe.exe windows:6 windows x64 arch:x64
343e5baa491e604bcc8e2530403cd703
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
imm32
ImmReleaseContext
msvcp140
??Bid@locale@std@@QEAA_KXZ
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dyl0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dyl1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ