Loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Loader.exe
Size

338KB
MD5

28a5b1deb1dcce8f4318bf875aa187b3
SHA1

a4805bc30583bea0db6bd1ef8728f78cb5b046fa
SHA256

366a344f4928c0bb00a86e68f1c8dff95a289eb3f2bd02bb62bf1f54b504bd5d
SHA512

854c5b40c62d753a8c54628580d6abd068d75acd935dd3dd01f028b6ead255bc124515aa979d2726f7c062d54c9a3d08f874c34954ca682f4e68c68df2d32bf7
SSDEEP

3072:LT2YBbsZ4PrzlegwLfEPrR3xX7hCzS14O044gIBFhpjIsOnI0uHo:Tb+Mr0X8PrRhX7hd7SFhpIs3Ho

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

Files

Loader.exe
.exe windows:6 windows x64 arch:x64

ff4cc7d273ee3d9272d9533cd4322418

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Windows 10\source\repos\Loader\x64\Release\Loader.pdb

Imports

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

kernel32

GetModuleHandleW
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
system
abort
_register_onexit_function

vcruntime140

_CxxThrowException
__FrameUnwindFilter
memset
__current_exception_context
__std_exception_copy
__std_exception_destroy
memcpy
__C_specific_handler
__current_exception

msvcp140

?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z

urlmon

URLDownloadToFileW

mscoree

_CorExeMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff4cc7d273ee3d9272d9533cd4322418

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

urlmon

mscoree

Sections

.text Size: 16KB - Virtual size: 16KB

.nep Size: 3KB - Virtual size: 2KB

.rdata Size: 312KB - Virtual size: 312KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 512B - Virtual size: 504B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 148B

.text
Size: 16KB - Virtual size: 16KB

.nep
Size: 3KB - Virtual size: 2KB

.rdata
Size: 312KB - Virtual size: 312KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 512B - Virtual size: 504B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 148B