loupe-v0.4.0-windows-x86_64.zip
- SHA256 4a598a07ebe5349e058d02f94f4389a90b224723d9a6ebd73a208580d82bace4
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loupe-v0.4.0-windows-x86_64/loupe.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
loupe-v0.4.0-windows-x86_64/loupe.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
loupe-v0.4.0-windows-x86_64/loupe.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
loupe-v0.4.0-windows-x86_64/loupe.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target loupe-v0.4.0-windows-x86_64.zip
- Size 1.3MB
- Sample261104-3tlrmses81
- SHA256 4a598a07ebe5349e058d02f94f4389a90b224723d9a6ebd73a208580d82bace4
- MD5 1fb34d208abc4962255061cc516b7210
- SHA1 22a20861a71b76e0a10aad5308b758047e132dde
- SHA512 74b822680372e38c192e7aa510432b0056cc58b1e95e2c944158319cc79d821a0d4cf2b04fc5a8e43c98ac956a87b7220ed16bf7a01f45ae277fa5a2ba1d6dae
- SSDEEP 24576:P8heCr/WwOkxslU4QMAbF2F5U34TFMtoVXDCfM1tCLlvI/rt:P8hr/W+sGRIsce6VOfMHCh+t
- TLSH T19C55335381B3CFB88B4D4277676E7868D935748249E709CBA737FB9C60EF1948826348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/loupe-v0.4.0-windows-x86_64/loupe.dll unpack001/loupe-v0.4.0-windows-x86_64/loupe.exe
File Explorer
-
loupe-v0.4.0-windows-x86_64.zip.zip 1.3MB
-
loupe-v0.4.0-windows-x86_64/loupe.dll.dll 1.8MB
-
loupe-v0.4.0-windows-x86_64/loupe.exe.exe 2.0MB
loupe-v0.4.0-windows-x86_64/loupe.dll
- IMPHASH b7e5d20b41f66471573c90420fb42a24
- SHA256 7f5a7bf9cf360c5968f7751913205660810fa9e15dff32d912f1e8278ade0e75
- MD5 03e9e5456fe1135e6d2355fb3403a7c0
- SHA1 28d9a56bfaabeb7bbbd17885d3e6d3987597e6a4
- SHA512 a84fb8162a3471cbb49379bd2ca489d505fec3cd5096baf0ec0a4fccb45a4fd575e717114b3263c794d6b58fe562b34a2119646b1cff4423b391afe7f9d6a3b9
- SSDEEP 49152:yW8d4ydE56n9D/A5kODUrfoiLhnstVNxz9y6Y13AcTzu9wVMaK0+/6/sHgG7mpZC:w5s0Vlh+FX
- TLSH T19795C4393269A59DE2A5C07CD6079E639761748E02387AF711E081E12F69C5CAF3D3E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
loupe.pdb
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
api-ms-win-crt-heap-l1-1-0
_msize
calloc
free
malloc
realloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
kernel32
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
ntdll
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrLoadDll
LdrRegisterDllNotification
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
NtYieldExecution
RtlActivateActivationContextEx
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlRemoveVectoredExceptionHandler
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
fwrite
api-ms-win-crt-string-l1-1-0
strncmp
_DllMainCRTStartup
loupe_blur_faces
loupe_detect_aruco
loupe_detect_faces
loupe_free
loupe_free_aruco_results
loupe_free_barcode_results
loupe_free_image
loupe_free_ocr_results
loupe_load_image
loupe_recognize_text
loupe_save_image
loupe_scan_barcodes
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
417KB
Virtual Size
417KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
62B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
loupe-v0.4.0-windows-x86_64/loupe.exe
- IMPHASH 554d6b7640d6023f00b1a4808550a742
- SHA256 df27c188e2a07c15103866484aa60b7a18684bc55c46b58170b9dac15c181c76
- MD5 871e8f6d5cf1f5c5bfb57f508c7c197d
- SHA1 a0b3738db4f7fba4cf1b5d240a899e06471f86d5
- SHA512 ab2be452611dd012c04cac61d3756dd7ca4a5617fb4efce4653c565d2f9c94ae7be8518947a387c2cad67fb04a65a340f9bd407ea7b07bfac6f39da33c2d5a8e
- SSDEEP 49152:6d1RmY6os+LVWOmRVR4n8VbbJ+2sPXUUnkxw/XP5W9j9Osfwkvy2sary9qFLxIU4:u0fMq+FXV
- TLSH T159A51A793199A9AED2B6C478D6078EA39721B04E133871F711D480F13F9AC589F6D3B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1095136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
loupe.pdb
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
ntdll
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrLoadDll
LdrRegisterDllNotification
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
NtYieldExecution
RtlActivateActivationContextEx
RtlAddVectoredExceptionHandler
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlLookupFunctionEntry
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlRemoveVectoredExceptionHandler
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
RtlVirtualUnwind
kernel32
CreateProcessW
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
474KB
Virtual Size
473KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
62B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
53KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ