New folder.zip
- SHA256 d390e60207433886fdcd09899251562d8db8bcc3fe88f22cb2a68898e9f2bba5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
patcher.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
patcher.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target New folder.zip
- Size 108KB
- Sample260709-3qvkdabz7s
- SHA256 d390e60207433886fdcd09899251562d8db8bcc3fe88f22cb2a68898e9f2bba5
- MD5 42b04e09d095e5460539074e0d560f6a
- SHA1 701f67c8dfcf53194d48c01981ad0866acda806d
- SHA512 9683c081b2e023f96ea24098696ff5ae135f745ea83e86a94947b19072687a3f7cfa5048982d07f2e399b80d8a17f925d71a4416b416d14c8d0a452014c6091f
- SSDEEP 3072:vrKzlMxKyc16Mn6XMPL+BCmfobFpWag9qoR+c:zBAjIMn6a0TopH2qokc
- TLSH T1E1B3123413A5BDFDA0793273229E54A1D3738EAE9238DECFC15410FC6B515DA3A41C5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe unpack001/patcher.dll
File Explorer
-
New folder.zip.zip 108KB
-
loader.exe.exe 22KB
-
patcher.dll.dll 238KB
loader.exe
- IMPHASH cab200490e0487da80fc5ae68a2a17dc
- SHA256 ce9b557439ac0df55abbb5db365b70e84adf53b826ed909c8018b0f22c4a0780
- MD5 1d53f25ebb49b695835ff33fa9034f76
- SHA1 87b6c8bb1df7c9cbaafba9109614a675ddeeeaaf
- SHA512 10b7c23c3acfcffde2aafce518fe5ac0c43a61b0d8a36ea3e1ba11713b138f4b0041821573fd1eb5308bd4e457adb1ab38d2fcb7f00172cd21fa44f3eb8b0d10
- SSDEEP 384:186KNiKg6MVHyZAI9p20JR2mkljIE6PjaxfNAbAxkH6pM90qSm:0fG0Jom+bAbAM6pM90Rm
- TLSH T190A25B56B7AB09E5E1BBB27C88621515E2B27E165722D7CF1380102E1FB63F1AD35B02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\perri\source\repos\loader\x64\Release\loader.pdb
kernel32
WriteProcessMemory
GetModuleFileNameW
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
Module32FirstW
GetProcAddress
VirtualAllocEx
GetModuleHandleW
CreateRemoteThread
Module32NextW
VirtualFreeEx
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
msvcp140
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?uncaught_exceptions@std@@YAHXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__current_exception_context
__current_exception
_CxxThrowException
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___wargv
__p___argc
_exit
exit
_initterm_e
_initterm
_set_app_type
_invalid_parameter_noinfo_noreturn
_get_initial_wide_environment
_seh_filter_exe
_initialize_wide_environment
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_configure_wide_argv
terminate
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33808,
count=10, id=260, version=33808,
count=25, id=261, version=33808,
count=6, id=257, version=33808,
count=3, id=257, version=30795,
count=92, id=1, productName=Unmarked objects,
count=1, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
patcher.dll
- IMPHASH 466045dd9a32136f3f3e971218c0fca7
- SHA256 e489703dbad95a1b9b9a66a4ae9480384dc3610739b270fd6cfc97ff01a81e15
- MD5 8f16b6eeeeb5d7f2805f70bf37733fe4
- SHA1 c45f66d5e876224592cb85e54b65c4bf13886e96
- SHA512 8044144838a28227d616bf380688507c69cd8dd2fc42c1f1917db9f49e2c91630b13dacfa5078a232085c221eeed11d695b0ed6ab639daee2967bdb14b0c2a04
- SSDEEP 3072:jTuriEMXPFezivSRs5PgfpVEFNXsSkdKqqXvolmw2bG3IHmUiig07yy7lhkf/Wgw:j+iBQRmiVWXJYKqhuQ7VcX/IoRn
- TLSH T159345C1DF1944C6AF527D039C903DA0AD7B27C54C760F6CB2BE4566A9E23BD86B3E600
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
162932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
SetWaitableTimer
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
MultiByteToWideChar
FormatMessageW
GetLastError
SetEvent
TerminateThread
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
WideCharToMultiByte
SleepEx
FormatMessageA
CreateIoCompletionPort
VirtualQuery
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
ws2_32
bind
closesocket
WSASend
select
accept
ntohl
listen
WSASetLastError
WSAStringToAddressW
WSASocketW
WSARecv
htonl
htons
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
memset
memcpy
memcmp
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_type_info_compare
_purecall
__std_terminate
memmove
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_aligned_free
malloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_seh_filter_dll
_crt_atexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
strerror
_register_onexit_function
_beginthreadex
_errno
_initialize_onexit_table
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
strcmp
strlen
strncpy
_wcsicmp
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35403,
count=8, id=260, version=35403,
count=24, id=261, version=35403,
count=6, id=257, version=35403,
count=5, id=257, version=33145,
count=149, id=1, productName=Unmarked objects,
count=2, id=265, version=35730,
count=1, id=255, version=35730,
count=1, id=258, version=35730,