ObsidianLoader[.]exe

Resubmissions

23/06/2026, 11:44

260623-nv94asct2r9

23/06/2026, 11:41

260623-ntvbfsct2k9

Sharing

Copy URL Twitter E-mail

General

Target
ObsidianLoader.exe
Size 339KB
Sample260623-ntvbfsct2k
SHA256 f13810446d0a05b3a98d134f6d41cb3d5dd0e010949482199f655e931ee40d73
MD5 3f2b5ef2224385113b2d8f23167dd1d9
SHA1 3d0a3d46840bed1f14aac2e70cc2b90365b1aef4
SHA512 e4774795227598c1484d4788e1abdfddbdc7bda39ae4ea59a217115b98cafd99090c8a7dd4f25378de997dec7ceb929b0f378df3ba2af4d4747a6de0cce80c69
SSDEEP 6144:zG9Brb7hMivOVVxNIfCDoYJT3oLYk38TdAtpDZ1cJXEg:078xNIfCDJgMTds9Z
TLSH
T17F747D5AF7A454F9E177C1B8CD424905EB73BC4607A0ABCF23A04A962F276D05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ObsidianLoader.exe

File Explorer

ObsidianLoader.exe

.exe 339KB

ObsidianLoader.exe

IMPHASH cce0ea1b2b5ad2a5e70bd59a1d4710c2
SHA256 f13810446d0a05b3a98d134f6d41cb3d5dd0e010949482199f655e931ee40d73
MD5 3f2b5ef2224385113b2d8f23167dd1d9
SHA1 3d0a3d46840bed1f14aac2e70cc2b90365b1aef4
SHA512 e4774795227598c1484d4788e1abdfddbdc7bda39ae4ea59a217115b98cafd99090c8a7dd4f25378de997dec7ceb929b0f378df3ba2af4d4747a6de0cce80c69
SSDEEP 6144:zG9Brb7hMivOVVxNIfCDoYJT3oLYk38TdAtpDZ1cJXEg:078xNIfCDJgMTds9Z
TLSH
T17F747D5AF7A454F9E177C1B8CD424905EB73BC4607A0ABCF23A04A962F276D05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpReadData WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider

shell32

SHGetKnownFolderPath CommandLineToArgvW

kernel32

QueryPerformanceCounter SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID GetCommandLineW WaitForSingleObject MultiByteToWideChar CloseHandle LocalFree CreateProcessW GetExitCodeProcess GetTempPathW IsValidLocale GetLocaleInfoW LCMapStringW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwind GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

user32

MessageBoxA

ole32

CoTaskMemFree

Name

.text

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ObsidianLoader.exe

winhttp

bcrypt

shell32

kernel32

user32

ole32

generic