Loader.rar
- SHA256 fda2b8a048a61de79643f72d1aed6a36292c14676fc64add8a4a41fed4dacd42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader/AzureXYZ.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader/AzureXYZ.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target Loader.rar
- Size 13.4MB
- Sample260812-v43txazset
- SHA256 fda2b8a048a61de79643f72d1aed6a36292c14676fc64add8a4a41fed4dacd42
- MD5 6f1aa26b2544757eb82c22479fc94620
- SHA1 c3bf97084f5bee606a029ba1d4b18e9f78be59c2
- SHA512 0b9898502dd1dacd1a408bd69f68845b928aa24eb6ed79ab4c308749808c6c1a471613503654eca831323f163a1990754e6c528707ab203faf39d8553a4ffcf3
- SSDEEP 393216:iwBnhm7768eVQmL8wji6Tou7zdnItJWH3QbmV:rh6ozji6TocKkH3QbmV
- TLSH T181E63348FEF569C8B4F91E2A34BF5795114E0CC642DFBFC8AB98B32F4448091E165E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader/AzureXYZ.exe
File Explorer
-
Loader.rar.rar 13.4MB
-
Loader/AzureXYZ.exe.exe 15.7MB
-
Loader/fix 102.bat1KB
Loader/AzureXYZ.exe
- IMPHASH 1a6c8229224cb831894aad471dc32010
- SHA256 29efe121e2874fbc3a91a47dbe3a61507c5d20884468664f8a40214f99e8aaec
- MD5 a598c7b6871c2b532f015b93f9743e82
- SHA1 4e478f6a2fec314c6587d05ca4f90926fc303634
- SHA512 e582effd5bab92335b07b2bf5a490e8375fc623e7aa3f4defae398ea362593449e8b2c57085ee6e4e3a069b3bb664028975bf12ce7835fe21fb0a7c72f025dcc
- SSDEEP 196608:pO4/OCJ0DgpkOU+TV3P2cOBOdk8RBORQOh/l8UEgfdfUP86v/7RqiLl4EXEQ8/pG:pGG0sp8HOkPlEU/fNUU6t/7
- TLSH T122F623C6A4F995ACC451C634E6852BFAE4CD745A4EB9582F7FCE0C027531C44CCEAA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15215227
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdiplus
GdiplusStartup
ole32
CreateStreamOnHGlobal
ws2_32
inet_ntop
crypt32
CertFreeCertificateContext
advapi32
CryptGetHashParam
wininet
InternetOpenA
winhttp
WinHttpOpen
kernel32
GetSystemTimeAsFileTime
user32
ShowWindow
gdi32
DeleteObject
shell32
SHGetFolderPathW
msvcp140
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
bcrypt
BCryptImportKeyPair
secur32
AcceptSecurityContext
iphlpapi
GetAdaptersAddresses
rasapi32
RasHangUpW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
Virtual Size
409KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.I_[
Size
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.e&N
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.|/%
Size
15.7MB
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Loader/fix 102.bat
- SHA256 097f72e565ccca18e2ea679fed5ef72f72dbbe7bf61c32d1a4493e41b03f42ec
- MD5 afe6e6f4a847ae91f4ad707f454105a2
- SHA1 640be818f694673dfab99c00a8af6d76eb26300b
- SHA512 57d714bcc27ece2d67c2a8cdc38ca18fcbdf870b81431852fbd3eed786f48c2444b347718b557471bee3299f68e4812bf518c13859a655046020b35673515551
- TLSH T1B431ED137CE161A506B2D8C14A761103FB20419F9B45BCEBB4B382782A123D0B7FF58D
- MD5 SHA1 SHA512 TLSH