loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

4.1MB
MD5

35629892caf5e5966e3c6f9d3d9e0fb2
SHA1

76afc1abf9c114f0b1383d6f8d3c3463756c1f9b
SHA256

10a1738efad78b1a082df3b3170ef321220a5e6e25a8b5e8b54b13a8354f82dc
SHA512

d7726885683608f8649cdb47ee2648936860bc032b798fcc1aeefbb8a153c253508050c0253b100b26ddeb36dcc5074d95e67afeac3b97acc421c38e9b070e80
SSDEEP

98304:s/lgQ/6SHQmzBVUovvIXw6fuJQ9XCXxuc8l2jSyj:BGHQoByqvKw62JQ9XCf

Score

1^/10

Malware Config

Signatures

Files

loader.exe
.exe windows x64

f9fd7a1dc19ad0ef54037766c450d2e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetProcessId
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetSystemMetrics
CharUpperBuffW

gdi32

CreateCompatibleBitmap

advapi32

OpenProcessToken
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCompositionWindow

shlwapi

ord12

gdiplus

GdiplusShutdown

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpOpen

ws2_32

inet_addr

wininet

FindNextUrlCacheEntryA

iphlpapi

SendARP

crypt32

CryptBinaryToStringA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-stdio-l1-1-0

fread

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mych0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mych1
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9fd7a1dc19ad0ef54037766c450d2e9

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

gdi32

advapi32

shell32

d3dcompiler_43

dwmapi

msvcp140

imm32

shlwapi

gdiplus

d3dx11_43

winhttp

ws2_32

wininet

iphlpapi

crypt32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 444KB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: - Virtual size: 440KB

.pdata Size: - Virtual size: 13KB

.mych0 Size: - Virtual size: 2.5MB

.mych1 Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 1024B - Virtual size: 680B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 444KB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: - Virtual size: 440KB

.pdata
Size: - Virtual size: 13KB

.mych0
Size: - Virtual size: 2.5MB

.mych1
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 1024B - Virtual size: 680B

.rsrc
Size: 512B - Virtual size: 480B