Loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Loader.exe
Size

26.0MB
MD5

0846eb953201963b55e9ff0cd06e4e67
SHA1

979df8e18400414adb5d75c923d74cf9e9798d21
SHA256

baa71cf63077412eab5bc6ea02858762db13b43253d12a710cf207dc0497674e
SHA512

acd31e4d75d5f0480ea34368ad7886742330c32cc5961b889e50c6d38321975f5a94b4109a2826babba5ec5348e9c2a7c98cf160d18fac2c660735cf1c6c4aa8
SSDEEP

393216:gUqozyB4cRJb58OosjQUtBTh6/aX03/ZPGBVDRCaK9IFdwigqx5wgT6kj/OnhfgL:TqozyLQCt6/ak0tCaK9Ib2q0I/i

Score

7^/10

vmprotect themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

Files

Loader.exe
.exe windows:6 windows x64 arch:x64

a6dc4ded159b11db7da9e298f58dda02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeviceIoControl
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

MoveWindow

advapi32

CopySid

ole32

StringFromGUID2

msvcp140

??7ios_base@std@@QEBA_NXZ

ntdll

NtDeviceIoControlFile

dbghelp

SymCleanup

urlmon

URLDownloadToFileA

shlwapi

PathRemoveFileSpecA

wintrust

WinVerifyTrust

normaliz

IdnToAscii

wldap32

ord41

crypt32

CryptMsgClose

ws2_32

sendto

rpcrt4

UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

shell32

ShellExecuteA

Sections

.text
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.enigma1
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.enigma2
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp2
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.arch
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.srdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xpdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xtls
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dsstext
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SPN
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Ethera
Size: - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ASPack
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vxl
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boot
Size: - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SWABRA0
Size: - Virtual size: 25.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.SWABRA1
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SWABRA2
Size: 25.9MB - Virtual size: 25.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6dc4ded159b11db7da9e298f58dda02

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcp140

ntdll

dbghelp

urlmon

shlwapi

wintrust

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

Sections

.text Size: - Virtual size: 1.6MB

.rdata Size: - Virtual size: 179KB

.data Size: - Virtual size: 38KB

.pdata Size: - Virtual size: 24KB

.enigma1 Size: - Virtual size: 16B

.enigma2 Size: - Virtual size: 16B

.vmp0 Size: - Virtual size: 16B

.vmp1 Size: - Virtual size: 16B

.vmp2 Size: - Virtual size: 16B

.arch Size: - Virtual size: 8B

.srdata Size: - Virtual size: 8B

.xdata Size: - Virtual size: 8B

.xpdata Size: - Virtual size: 8B

.xtls Size: - Virtual size: 8B

.themida Size: - Virtual size: 16B

.dsstext Size: - Virtual size: 8B

.SPN Size: - Virtual size: 1B

.Ethera Size: - Virtual size: 3B

.ASPack Size: - Virtual size: 1B

.vxl Size: - Virtual size: 1B

.boot Size: - Virtual size: 2B

.tls Size: - Virtual size: 1B

.SWABRA0 Size: - Virtual size: 25.4MB

.SWABRA1 Size: 6KB - Virtual size: 5KB

.SWABRA2 Size: 25.9MB - Virtual size: 25.9MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.6MB

.rdata
Size: - Virtual size: 179KB

.data
Size: - Virtual size: 38KB

.pdata
Size: - Virtual size: 24KB

.enigma1
Size: - Virtual size: 16B

.enigma2
Size: - Virtual size: 16B

.vmp0
Size: - Virtual size: 16B

.vmp1
Size: - Virtual size: 16B

.vmp2
Size: - Virtual size: 16B

.arch
Size: - Virtual size: 8B

.srdata
Size: - Virtual size: 8B

.xdata
Size: - Virtual size: 8B

.xpdata
Size: - Virtual size: 8B

.xtls
Size: - Virtual size: 8B

.themida
Size: - Virtual size: 16B

.dsstext
Size: - Virtual size: 8B

.SPN
Size: - Virtual size: 1B

.Ethera
Size: - Virtual size: 3B

.ASPack
Size: - Virtual size: 1B

.vxl
Size: - Virtual size: 1B

.boot
Size: - Virtual size: 2B

.tls
Size: - Virtual size: 1B

.SWABRA0
Size: - Virtual size: 25.4MB

.SWABRA1
Size: 6KB - Virtual size: 5KB

.SWABRA2
Size: 25.9MB - Virtual size: 25.9MB

.rsrc
Size: 512B - Virtual size: 480B