E�SX�"���b�K7��ٙH����, �����=�����p�i�����Lv��\T�R�e�����vtv� �O��ՏȤ��=:YK�� �^C��̷O~Ԍ����Q:T����A1�6����*���]?��h��!� &fV`�ֆ �г� ��^����:z=��6��SnK���7�]����9�?!��=�L�8����6����-.���Q�T��gC��k���x��"G��E=oX�,�� �������3m�R�.]���2Ó��^R��X��;'E�����a�[���`�M�:�)�|���i��[������ؚzFQ�0��ZD��5�|�C0F�M/��������E{�kW�E'��/g�����>zhg��^��44i7�E傑�xgrp^�Y��p����e�tZ��!�`L�2���K&�zD↸b%`�"�ՠێg�{�m ��6}?�L����'����T`T=�^�vrM8�w����>F湓T�����~zj-@�mS�+��us����.5p��b\:�=��J��W}ڊN�G�lA�,��B�Ȏ���xF�&�oi�_r����年�w��:h�4����m yI~�瀉w8"�,�+�� ��l��Iy�:6L5d�d���Z�ػ2e�t32 ��g��xm���e�:��-��V^5�W�"Cw_m�g�hW}��M���lH-�F�qe#�6=3շ�b/;Q���t�G\=5�X|�u� �Ԃ�����U�+I�J+��S#�P�_c��ɍ�'�f�6����h�a.�a~\����<���oi�q��&x��zs�c��a���7���t����Q'<�;[��4C����6Y���\/[_َ��H���&d�IX�DR�O�*a��1��= /���XF�~�<��@��e�;k���-�?>]qA�Tac����>D4���h��邵4�SjP47 p��IqN��k*m)�!ODBV>jZ�LO��B���)E-��݈�X�Y�P�kG�\����p]c ��7Vc���!�X>�yĦy��O$���� ���d������惸!��h*���F��s;�������+��c����ؿb���G��>��&d��秩ؕܙ/P���X9��YH��� �?��N(����]�d���nts5�� 5��N䂓���D��@$���mA/��Sf2����H��L#�I�m�e� Qr�����:h�I2f�<�F�M�F �|r�/ z_#�f�yF@T�a���x%,��h����ğ��h������|Hf}�8yH ɕ�]ƴT����Bȏ�Z�Ǵ��Q�`�鮁f�T4�;�p'[�u�T��� �-�25�*b�u-7��+��*��v���$\���'��|����4E�t<z�JRb�n��������O�s9��(���T�³���2n�$��0G���Hh5;ͯ�37w�����%� ��TS���=�O�1GrI�L>��#�nQ�Hf}5kh�uy�p�۔����<ӊ��t�{�̛�it ��Z��ګn�6Q�v�V��߂��V��7 T��G���>ɶ��4�Q��6&P�;�4i�V�Z0LJ�IM������l��|o:V�!>�ߥ�>�RϏq��/�9�|8}���^$� `Ɖ�ڌ ���!��M �7��ʸ/��ɮ��v�bAR��nd��]���xC�7@���^����p�](t�N@|Ӝ�r�"�kS�A]�r_=�qWeQ�$$Ӫ�qHI��,Xd#��O�v9Ͼ��=��ש�}�7�[����G���V�$�%�AA~ �o�� ��.x��6�W�[�i�X�[P�Z����"��+�]I_�7[�u��*�߇9�')�|!��@�<d��F,D����'mI��k�,D �g�8�W�T��n�t1(u���'�������d_}�=�>Z�������3��1@�&�0k��u���k���~E���y;��I���'G��;�iQ�j%ۖʽ��w�A[],��y���%z���).Q�8�9��!R.�_�w�:lS:A03����u�ȸ��1v�E3L.�I�WK+Q�����m P�ivx�c�f�~�WN��i\x�@����3�t 0#�i�F�|��D�5��9x�Ͼ�Է��6�d_i�{*�bĚ5��VwTa涙h�9��4�P�:�B��E����A�E�)��]6�_�ipY��V��fVw� �N ��{&ch�W{qEn�n��_USK�/x��B C<���~��2e�Sc|�u���b��wF}^��]J���W�o������;*�Mf#`^�(�ϧ�*x�%h T��lE�o����?��FA7}���J��(���nCL�L��x-FY�M���z�p�*{.��������(���hV�-��f�㊲3��-�ΦYG|�x �%��զ�YwTYg]v�A��&��"�j]k�����,�� 7��%N(�7����� �0G��IT�f�HW�����w�>��"��[����Fe���ȉ���[��#L!�k��-d��T�:i�ţI T[ڈ}UIZ��7�*���7$b��}Y�Z�oN�}�D������ا|ն��rQ&��X��s�Gp�Is��Dy����ʤ7�:���~��&dU恐�!��ayT~��@� &�)��BG'z�R�"��B0�[��k ��E��q�(�jֿ%�Z焉)W&a�K�� R� �rX���0i��^8�g�c���?��;��N`�)�T]Y�f�ht�=�~�T���c:�1�Sq{�<'Ax�%Z~=ˈWO>��zrt�H�ܑW��|)=����5; �;<�Æ�I�� �J#wԅK�Mr-<yx p�����h)<�"6�!d���?8ah%��}�b����3�FH�������ÿTM�AO!�}^�2�� T�Tp]���}��To�)lHA�_8�4����v���fK+E�_5K��A�6�Y����/i,��{���V"`��2��<����4��q\�_l�����,�5Y^fT�UIh0� R�G�R-�E�����O�,|��ঠ���# 0��
Resubmissions
28/03/2025, 23:09
250328-247w7avpt6 7Behavioral task
behavioral1
Sample
VioletLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
VioletLoader.exe
Resource
win10v2004-20250314-en
General
-
Target
VioletLoader.exe
-
Size
5.6MB
-
MD5
096d065c40c4947b28b1f55d4cb9f08f
-
SHA1
9d80dd4253d2bf0f04f403000fd9494710ec41f4
-
SHA256
9b62a2f2268fc861154836091deaa49607a79a292b6a753370e085507436329f
-
SHA512
988530094f4174dd9a891b9b9195c47e4f976d05325a05131fcaf268bba12d5573b1121ada50b8b113759fdcc8830d74b80d0d1d08460d049b7aef8507d4a537
-
SSDEEP
98304:rBaY/uK2fkMPIpXy8+12wONBWYcYX96eD+ESGnyXcwtdF6oCg2uz3V:tauuK2sMPIBjdDHt6epStMEqgj3
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VioletLoader.exe
Files
-
VioletLoader.exe.exe windows:6 windows x64 arch:x64
1f53f30fd29413e0cac8dbf4e2f63e51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
FindFirstFileW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
dwmapi
DwmSetWindowAttribute
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
crypt32
CertFreeCertificateChain
ws2_32
WSACloseEvent
shlwapi
PathFindFileNameW
psapi
GetModuleInformation
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
advapi32
CryptAcquireContextW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ