General

Malware Config

Signatures

Files

• Loader.exe

  .exe windows:6 windows x64 arch:x64

  932e6ee7c68e5e66fbe296ee72a85ece

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  crypt32

  CertGetCertificateChain

  wldap32

  ord217

  kernel32

  GetCurrentThreadId

  user32

  SetWindowLongA

  gdi32

  CreateSolidBrush

  advapi32

  CryptGenRandom

  shell32

  SHGetFolderPathW

  msvcp140

  ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

  imm32

  ImmReleaseContext

  d3dcompiler_47

  D3DCompile

  dwmapi

  DwmExtendFrameIntoClientArea

  d3d11

  D3D11CreateDeviceAndSwapChain

  ntdll

  RtlLookupFunctionEntry

  shlwapi

  PathFindFileNameW

  rpcrt4

  UuidCreate

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  strchr

  api-ms-win-crt-stdio-l1-1-0

  fgetc

  api-ms-win-crt-heap-l1-1-0

  calloc

  api-ms-win-crt-math-l1-1-0

  atan2f

  api-ms-win-crt-convert-l1-1-0

  strtol

  api-ms-win-crt-filesystem-l1-1-0

  _wremove

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-runtime-l1-1-0

  __p___argc

  api-ms-win-crt-string-l1-1-0

  strncmp

  api-ms-win-crt-utility-l1-1-0

  qsort

  api-ms-win-crt-time-l1-1-0

  strftime

  api-ms-win-crt-environment-l1-1-0

  _dupenv_s

  ws2_32

  htons

  normaliz

  IdnToAscii

  Sections

  .text

  Size: - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 238KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 619KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .G}?

  Size: - Virtual size: 7.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .F2c

  Size: 1024B - Virtual size: 568B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ab/

  Size: 12.2MB - Virtual size: 12.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 272B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ