loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

4.2MB
MD5

45877c5b43c70ec0ca2a36570dcbc7b0
SHA1

fd9d54dcd3097a2fd2d32b56816172a56511d194
SHA256

eb8cbbfed868c807a3a4bc115c5782c350b2f491b6613b3a39fee9a3d957aed1
SHA512

3c2d51d563ab42a8c7831fcb28e34bba278d21e2f39170d2f5c5bb84d7bb65f0dee22a3427677e642515cd5bdf2cb723bb5e5ae607ee893e3e30426c160f6b8e
SSDEEP

98304:bd7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6K:I+y4ihkl/Wo/afHP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\guill\OneDrive\Desktop\important\Slax important product\Slax paid perm spoofer source\Phantom-Solutions-Perm-Spoofer-main\PhantomSolutions\obj\Debug\loader.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ