TT_Loader[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TT_Loader.zip
Size

3KB
MD5

e401d7c7dea0b167ca285f868feed26f
SHA1

693398028fe5d72fa16073c2ff2bc5ceda63aa90
SHA256

056784c940be9469cbcfaa1198776e2a93e5d71b0ec83fbb5eb0ef74fb07e8ae
SHA512

479bef6970118b0e89507f6e4d63b324ea962f154be862be7e9fc35395d19aa9245176d01edd04b8763e27ac28120a233c20172c86c93e5653dbbd5eabdb1410

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TT_Loader.exe

Files

TT_Loader.zip
.zip
TT_Loader.exe
.exe windows:1 windows x86 arch:x86

73500c9a194467c04dac9d62e5981ab5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
CreateProcessA
CreateFileA
GetCommandLineA
GetFileSize
GetThreadContext
ExitProcess
ReadProcessMemory
ResumeThread
SetFileAttributesA
Sleep
VirtualAlloc
VirtualFree
WriteProcessMemory
ReadFile

user32

MessageBoxA

Sections

.text
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ