Fodoloader.zip
- SHA256 b8ad9d2f91744e526ee2799a65768d676ba85df6125511d71d1a41497b03f880
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Fodoloader.zip
- Size 18.4MB
- Sample260901-2c8dmssxaz
- SHA256 b8ad9d2f91744e526ee2799a65768d676ba85df6125511d71d1a41497b03f880
- MD5 b3f0ce4ab7b046a00180d5be49378db7
- SHA1 2db24a3e815403acd56580354c112f5f17df402e
- SHA512 f59c19db7cfff72bfa1e7bc7bb2be2af0f983ddf2876d07944d4aaa4716a50af795014ab60f97c0012f0dbc804d27bd34d5f2bcedee20f5a25d72175793cdcf0
- SSDEEP 393216:SlhSUI5LI+5ygHJVdwBm3SLuN61t+7hOwgsdILOkz:SXSUIadaXwr6N61t+7Iwg3Lzz
- TLSH T1FD1733F9C7A4E4BE8BDAC63A10E0DDB7CCD5799CAB80DB05A3D9889315F9055081B3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe
File Explorer
-
Fodoloader.zip.zip 18.4MB
-
.config36B
-
loader.exe.exe 20.1MB
.config
- SHA256 45182da54c3dbb7d9af2c6e1f200f94970b1847b68039b859c399bb3b774849c
- MD5 e4b12a8fd777855ccc85ca02d5069990
- SHA1 38f7432317c2e06f66de8a45e0d1f73238107506
- SHA512 0a9ef7162d4398a7e49dd0d0cd18bc9a72d3ac97a70388cf17905012e759b0e6f9ee445ad9b258d61b290d6ff711a54ef10c5812d949118a1d6e115119f52a92
- MD5 SHA1 SHA512
loader.exe
- IMPHASH cf125eacfe25296a43ff37467c728d88
- SHA256 620890674d5fd3607e26f034b1d4a020956fe1902cb80824293ee4a49f344e0c
- MD5 8e54a8042b791d5f01cf529f0054c735
- SHA1 3109b69ff6fca35c6649849a7b9202ed7958f809
- SHA512 f96274111693e661e00f2cde795babd4db9ca9a4827fbe9dd530d1df83d8add14bea4fdc193764b6168d71f74058a37c8b34bd2ccd8accc11d77e3aa949728fe
- SSDEEP 393216:ywbZdiw0459I+BU61NfNE74bQGn18C0QpG8:1bZdS4c10lEXGn18C0QpG8
- TLSH T1662723D7C6C44BF48793854DA09B03CFF1C0A59AD7EA5E0D3A865C0236A0E5A474BFB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16009231
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTimeZoneInformation
user32
GetWindowRect
advapi32
CloseServiceHandle
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SysAllocString
userenv
UnloadUserProfile
gdiplus
GdipAlloc
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
setupapi
SetupDiGetDeviceRegistryPropertyW
d3d11
D3D11CreateDeviceAndSwapChain
bcrypt
BCryptGenRandom
secur32
InitSecurityInterfaceW
iphlpapi
if_nametoindex
ws2_32
WSAEventSelect
crypt32
CertFreeCertificateChain
Name
.text
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
389KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.3P+
Size
Virtual Size
12.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.)d<
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.t;-
Size
20.1MB
Virtual Size
20.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ