Static task
static1
General
-
Target
Loader.exe
-
Size
593KB
-
MD5
7513aaaa736bf8d2b2a6d06a007fa6d2
-
SHA1
00d0077fd72d0046da42744474728b668776a1db
-
SHA256
2f2b62f010f743124767b36ed6e0c3f885a1ad0db036a65dca5f7ec20dc74919
-
SHA512
d8e0cc24274a075ea7ffd6745eb6d294de3639fcd51765499cab1966f53dff7f365325ab523280cca7b456eb23930f7776e77a968485a5f796932d4bcb424567
-
SSDEEP
12288:fmeOfxCoEB9DzYwLM8sNfuuKSmtkTGKKlmJj9//k/rTcPcYYYgYYYYYYYgYYYYYH:fxOp5uVLyqKKlmJj9//k//Ic
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x86 arch:x86
579cb4ce6434c0102bd5483efbfa6f2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CreateThread
CreateToolhelp32Snapshot
Process32NextW
OpenProcess
LoadLibraryW
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
LocalFree
DeleteFileA
GetModuleFileNameW
GetFullPathNameW
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
FormatMessageA
GetCurrentProcess
MoveFileW
DeleteFileW
WriteFile
GetLastError
ReadFile
GetFileSize
CreateFileW
CloseHandle
VirtualFreeEx
CreateProcessW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
WriteConsoleW
user32
MessageBoxW
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DeleteService
ControlService
ChangeServiceConfigA
StartServiceA
CloseServiceHandle
CreateServiceW
OpenServiceA
OpenSCManagerA
ws2_32
send
gethostbyname
WSAGetLastError
htons
connect
recv
closesocket
WSACleanup
WSAStartup
socket
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vm0 Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ˍ���u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE