loader[.]exe | Triage

Sharing

General

Target

loader.exe
Size

449KB
MD5

8e7b05b2619264cb09cdf0facea25fa8
SHA1

2303f4230cf473d262c9eb07024a0831470fcdc4
SHA256

a359cc3afe203ca5927a118b8c89166c639b7ad1d80308d8f4abd4e7f85fb625
SHA512

b287909d8da997efcf7eeabe0d416999549852cf28e3c8434f845e7d47e6ed7b4d44e674ed49cfd4b982826df5882307c8f4b33c7b260fdda7dd37c602f04aca
SSDEEP

12288:V40xCD/hKMldZaXF5oVGamXx7pOUr9q/dtr5RyIp:60wtKMldZCF5A1+9q1trHp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64

7cbbc6b200d04e1a24e316620e720e7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA

advapi32

RegisterEventSourceW

user32

EndDialog

shell32

ShellAboutA

Sections

Size: - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 447KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE