loader.zip
- SHA256 d9fd29f0ad31d5d80267d608c6293e808cc495453d4a89afd87b85ab31628d5c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target loader.zip
- Size 15.2MB
- Sample260828-c8lr3ssfpe
- SHA256 d9fd29f0ad31d5d80267d608c6293e808cc495453d4a89afd87b85ab31628d5c
- MD5 9a4392d40471bc522aabcc92d234d175
- SHA1 21eda9872da4312a90878ff05ca96cfb1abb0b8a
- SHA512 33ffa1496275fb044555210451c543e02f4b274ab37f21f5683fc4a5c4a007aea3589659748e2e3e9964c0d0ca4f5102f1656061b8048124ccea58470dad01e8
- SSDEEP 393216:k3rxyTxxywrX4MD4DtAjgT8NhqYbYMCvQPWlGMyVm1j8M4A:g0XN4DtA+YbY5oPdVm1vB
- TLSH T110F633F54D33F5B3979319B8B788225B18DFB4BB8865028A7285FB1C86D40894F6D339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe
File Explorer
-
loader.zip.zip 15.2MB
-
loader.exe.exe 18.0MB
loader.exe
- IMPHASH 61721c42ee4289228270e26dbfe3b6e9
- SHA256 a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c
- MD5 fc4c13973d35400640794fef290476ab
- SHA1 1f363819b1644942838c972be35ed95e42defee7
- SHA512 acbd0e53b324f8d5ffc086b63eaf8535bd60590dbeab9ba26c910fbcd3d6e5d977465e9e3a65501d030be0850853e1cd4777b5d707bd191fe2726b2d03599d6a
- SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw:ee3Zqd5My9lqnSw
- TLSH T1B71712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18929558
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
RemoveVectoredExceptionHandler
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetProcessMitigationPolicy
SetProcessMitigationPolicy
GetSystemTimeAsFileTime
GetTickCount64
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExA
LocalAlloc
LocalFree
CopyFileW
MoveFileExA
MoveFileExW
ReplaceFileW
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
SetFileAttributesA
InterlockedPushEntrySList
RtlUnwindEx
WriteConsoleW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
AddVectoredExceptionHandler
HeapQueryInformation
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
SetErrorMode
GetLastError
CloseHandle
GetTempPathA
ReadFile
GetTempFileNameW
GetFullPathNameW
GetFileTime
GetFileSize
GetFileInformationByHandle
FlushFileBuffers
GlobalAlloc
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
DeleteFileA
CreateFileA
CreateDirectoryW
GetCommandLineW
RtlDeleteFunctionTable
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
RaiseException
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
RtlPcToFileHeader
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsGetValue
WriteFile
SetFileTime
SetFilePointerEx
GetTimeZoneInformation
GlobalUnlock
RtlUnwind
FlsAlloc
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
InitializeCriticalSectionAndSpinCount
user32
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
TrackMouseEvent
GetKeyState
GetCapture
SetCapture
ReleaseCapture
ScreenToClient
IsWindowUnicode
GetForegroundWindow
IsIconic
DefWindowProcW
wsprintfW
LoadCursorW
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
advapi32
SetSecurityDescriptorOwner
AdjustTokenPrivileges
AllocateAndInitializeSid
ConvertSidToStringSidW
SetNamedSecurityInfoW
SetEntriesInAclW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSaveKeyW
RegRestoreKeyW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCloseKey
LookupPrivilegeValueW
GetFileSecurityA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
FreeSid
OpenProcessToken
shell32
CommandLineToArgvW
SHCreateItemFromParsingName
ole32
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SafeArrayGetElement
SafeArrayGetLBound
VariantInit
SysFreeString
SysAllocString
VariantClear
SafeArrayGetUBound
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
netapi32
NetUserGetInfo
NetApiBufferFree
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
propsys
PSGetPropertyKeyFromName
Name
.text
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
422KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.|rJ
Size
Virtual Size
10.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.GCT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.)>,
Size
17.9MB
Virtual Size
17.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ