Behavioral task
behavioral1
Sample
409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9.exe
Resource
win10v2004-20241007-en
General
-
Target
409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9.exe
-
Size
6.0MB
-
MD5
96d2e7dc4e73e70e7316b279f53d6635
-
SHA1
a1ef108b30292912f771c88fa1152292d6422cf8
-
SHA256
409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9
-
SHA512
1db227f48dc18025bc3388f6d0fe793646f04589c9a0306b1b5cad5de5a7aa4da8fca35d843d0e9210ff390cac5c1ab7a469be286287cfe9e169426d1d318cb7
-
SSDEEP
98304:xX+ZGhCrY9Fr8af3Cy+UsPQ4mtBuvQbmRPFWEr38QcdfQZcht/c5ilvTilNZwmMp:xuZTc9yaKy+UsPatBuYyPQEadfQZSK0
Malware Config
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9.exe
Files
-
409bff384b4e1606b5681e35cc669ca1c488fece9e357a8a30fedb23996650a9.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp`*0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp`*1 Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp`*2 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 64KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ