ST_External_Loader2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ST_External_Loader2.exe
Size

23.7MB
MD5

65c3909070e59124989a986a3a7213cb
SHA1

47c515d65fd3443aa9324783c59a94ae60ea1db1
SHA256

066ba0597b4784d846d629a65c6ab74174c3e2ae51020302843799a9827e5446
SHA512

77e60f12f551391a73c625383dd79833083fedc3835c9bf086b8f48fc408620b484c3addc679cfc10e652c590e878b546531bd9bc8f89b97cf08d70a1af1f8f1
SSDEEP

393216:aE6z/FgDj8x9ppBVwiXIX6ECKvWpfU7EkBs4OQNyTOJ4HYYAKGyG5B0:buFgDQx9bNPeOps7l/yTOJJ315

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ST_External_Loader2.exe

Files

ST_External_Loader2.exe
.exe windows:6 windows x64 arch:x64

10e47936648e6fb0685a4c1e032d0d89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeviceIoControl
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DestroyWindow

advapi32

RegCloseKey

shell32

ShellExecuteA

imm32

ImmReleaseContext

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z

ntdll

RtlCaptureContext

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

isprint

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 605KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xorstr0
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xorstr1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xorstr2
Size: 23.7MB - Virtual size: 23.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10e47936648e6fb0685a4c1e032d0d89

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

imm32

msvcp140

ntdll

d3d9

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 605KB

.rdata Size: - Virtual size: 350KB

.data Size: - Virtual size: 4.0MB

.pdata Size: - Virtual size: 12KB

.xorstr0 Size: - Virtual size: 11.8MB

.xorstr1 Size: 4KB - Virtual size: 3KB

.xorstr2 Size: 23.7MB - Virtual size: 23.7MB

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 15KB - Virtual size: 15KB

.text
Size: - Virtual size: 605KB

.rdata
Size: - Virtual size: 350KB

.data
Size: - Virtual size: 4.0MB

.pdata
Size: - Virtual size: 12KB

.xorstr0
Size: - Virtual size: 11.8MB

.xorstr1
Size: 4KB - Virtual size: 3KB

.xorstr2
Size: 23.7MB - Virtual size: 23.7MB

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 15KB - Virtual size: 15KB