Loader.rar
- SHA256 46613bc14f4209c0d24feeb1c2964f32adbacbd9f0256d3a83527dc6ec0170d0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader/AzureXYZ.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader/fix 102.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target Loader.rar
- Size 12.5MB
- Sample260817-epc2yahd57
- SHA256 46613bc14f4209c0d24feeb1c2964f32adbacbd9f0256d3a83527dc6ec0170d0
- MD5 da070301179ff54ed501cb1e28826bee
- SHA1 a45fc2a6a1336eaa7544ffe84fd037cdd4682a01
- SHA512 124dbdc4550e836530d9d2f1659e08a9459b54b63e54ba0a540a360b2205dc1d642ad75502fd430551d55eb33ffa8bd183c928448d6cfbc6be82cf96dfb24243
- SSDEEP 196608:Z6TuzfOA9ggS5Mpc6eTONmC1MzlMBhmbmXcGyOQGJqTi6UmkPJyqMlZS41vo:Zqqa35cSTOjqzl2+bm0i6UX8PZo
- TLSH T16FD633691E50F26E233CFFEEAA8E8D5B22E25DA07FA4BC4FD6514F4B510123818715C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader/AzureXYZ.exe
File Explorer
-
Loader.rar.rar 12.5MB
-
Loader/AzureXYZ.exe.exe 14.5MB
-
Loader/fix 102.bat1KB
-
Loader/license.txt34B
Loader/AzureXYZ.exe
- IMPHASH 87bf18deb23a7934763e5fa7a3f6d2f9
- SHA256 c7caeb2416b00fdca09d998d1712d9f44251acdb4e338d690f06ef9aee2ff615
- MD5 8a95199f862e511d9c9ef1e0d24425c5
- SHA1 b0328ee194ecc760917c6e8749d52103ff14ce8e
- SHA512 e6fe0328106bb2fbb3c9f2c3ce63471779398b0631777fb1bd84586445118e9cd23427dc39442385396af1006d6ecf5bc98294e6c90b9a379f087ea6f294b285
- SSDEEP 393216:54XgI/i/QL4rSYunfD2Ou60d91W2rFLPKw0hr31:eXgI/i/gUSt2j60D1Z5Ow0hT1
- TLSH T119E623C479D182ACC491CA30DAC667F9F0DA35890EBE991F7F8B59023A31C19CDB6935
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15815096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
dwmapi
DwmEnableBlurBehindWindow
gdiplus
GdipSetStringFormatLineAlign
ole32
CreateStreamOnHGlobal
ws2_32
accept
crypt32
CertStrToNameA
advapi32
CryptDestroyHash
wininet
HttpQueryInfoA
winhttp
WinHttpQueryDataAvailable
kernel32
GetSystemTime
user32
CreateWindowExW
gdi32
CreateDIBSection
shell32
SHGetFolderPathA
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
iphlpapi
GetBestInterface
rasapi32
RasEnumConnectionsW
bcrypt
BCryptSetProperty
secur32
InitializeSecurityContextW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
Name
.text
Size
Virtual Size
628KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.h{p
Size
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.#yl
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.\$s
Size
14.4MB
Virtual Size
14.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Loader/fix 102.bat
- SHA256 097f72e565ccca18e2ea679fed5ef72f72dbbe7bf61c32d1a4493e41b03f42ec
- MD5 afe6e6f4a847ae91f4ad707f454105a2
- SHA1 640be818f694673dfab99c00a8af6d76eb26300b
- SHA512 57d714bcc27ece2d67c2a8cdc38ca18fcbdf870b81431852fbd3eed786f48c2444b347718b557471bee3299f68e4812bf518c13859a655046020b35673515551
- TLSH T1B431ED137CE161A506B2D8C14A761103FB20419F9B45BCEBB4B382782A123D0B7FF58D
- MD5 SHA1 SHA512 TLSH
Loader/license.txt
- SHA256 b72d65e518cdb15e9d70ff875322b42a0e61c62f23be3ea3cb4717d6d9e3db06
- MD5 e931f24eab306b3443a82d49ee8bd067
- SHA1 cba760598c5d1d1a958753305ec7801b5e704f06
- SHA512 637231b5ae1006bf7d290d809f29c728ca03d3def2729a9d7ba148dced3aa5ca1910df03b0b17fb90ab6fcd52f77ccdc509f2b528a1bf8b7a088f46306b6ed63
- MD5 SHA1 SHA512