bazarloader | 5ad6238f5ff9e75b51ad4d23a8ec459ce2547f441969ee029d0499ef2213ce4a

Sharing

Copy URL

Twitter E-mail

General

Target

5ad6238f5ff9e75b51ad4d23a8ec459ce2547f441969ee029d0499ef2213ce4a
Size

73KB
MD5

4e36b00e9506f3f3e0bf727d344c853b
SHA1

0df3e26e416cef764af00fe0df9099d59a32d2dd
SHA256

5ad6238f5ff9e75b51ad4d23a8ec459ce2547f441969ee029d0499ef2213ce4a
SHA512

342fe0381e767df147ae0d306e02c072eda2875f0cc0abc68af6a66c69dbe19c18c62e519817201b03280c6ad2c7dc448bbb0de864d2217fc11a9a22d9639889
SSDEEP

1536:GqOne6WFpvQeWCsvi5IjVD4LnLaVWKKcRoUwWXVgk:GqGF66WCwWXVF

Score

10^/10

bazarloader

Malware Config

Signatures

Bazar/Team9 Loader payload 1 IoCs

resource	yara_rule
sample	BazarLoaderVar5

Bazarloader family
bazarloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ad6238f5ff9e75b51ad4d23a8ec459ce2547f441969ee029d0499ef2213ce4a

Files

5ad6238f5ff9e75b51ad4d23a8ec459ce2547f441969ee029d0499ef2213ce4a
.exe windows:4 windows x64 arch:x64

c86a15ad8daa9fda8a1aa35746d80e0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_fmode
_initterm
_ismbblead
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
signal
strlen
strncmp
vfprintf

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c86a15ad8daa9fda8a1aa35746d80e0f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 64KB - Virtual size: 64KB

.data Size: 1024B - Virtual size: 912B

.rdata Size: 2KB - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 540B

.xdata Size: 512B - Virtual size: 404B

.bss Size: - Virtual size: 64KB

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 168B

.text
Size: 64KB - Virtual size: 64KB

.data
Size: 1024B - Virtual size: 912B

.rdata
Size: 2KB - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 540B

.xdata
Size: 512B - Virtual size: 404B

.bss
Size: - Virtual size: 64KB

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 168B