Loader[.]exe | Triage™

resource
Loader.exe

Loader.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 6f9116db92381f164ff21cba239df259ccf95f4816b8e35eebc8cce41358d5d4
MD5 4710d4052b61a26c3bde93a8991f4622
SHA1 8f5c3b1e323218b9cfb3b4964e21cc17217892df
SHA512 30809710eb5f41b1b9c1ade6993583e2741e7084c13c7ca18f600912972073b3886f7612655fff56b14d82529292372337fb9b6acac84694760b7047fd253b60
SSDEEP 24576:GbWQwWXZtzUZ9P7aFwYJ3P+DAH2FqbOmnz2rJzeJNrBZy2HYgoZXsOmETl+rLAX7:8PYZdGqYR2kXCAKrcvmng+RB+rMXFt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

2024

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$INTERNET_CACHE/Alot

SHA256 de680ec7200ea44d839cc989de906548abf614cfbc70c4a26ec3132f4f258862
MD5 1a155014b98ffb915a962e53880469a4
SHA1 fe1924e8da29d734e652ff7cc34832c2e9648c8b
SHA512 303fab85379dbf8d1144c9a885a8989405db05b68a25e8d347758509d1fd7478a45f31a0ea1a629332df6470bb5a77d5f427a1614537a61eecffee1843afa373
SSDEEP 3072:WBzLZDKJtIs8di/37EM/j2xQeixApVIa0/vidXqGjLPQ6ClAMfA4lelIJBSLPX:WBnGtINsegA/12vk6AQzyMfA+e/
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Clearing

SHA256 d4facee65509e71c6b9b9f76cf44fb4a4c507c2143c0f4eb6d820866632acc87
MD5 d6e6a621ff6889ffc88ba576b8a80aa2
SHA1 f5983d265ef61aff54db6d9dcdabe79cadc4baea
SHA512 7eeca30e27667c9c0dad4e020c0b82d0d631517dd9df19fdc70a6ec56aeff1c91dc35f24a41da7b331bfa309cd82899a4212506269e14d2bd9c8e43df64bfccb
SSDEEP 1536:V+WO009KoGm3Ozm3Ocm3ObCJT5CF/0tjRuR9FiKsLd5ENVrOV+V0/vDfeM/HLzlK:V+r9Ko5C3CRGLd5z7ZVdZa
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Emotions

SHA256 1b13c2e41435e07a99fa895934a06c96d75e26203372ec4ea4cd27c08132bb87
MD5 33b57d652861cb4de09da1892b054b2d
SHA1 166a6fc7182439007cd1b93a3ee133b24691af3e
SHA512 39cff4f3ccf73f9bd8ba406f77bdad6b14db71ef947624d766328260b87a41580689b04d5d593696e7167e3111cf807dea7113de186abce2601e9853029212e8
SSDEEP 192:TUdXiFSmTeMyt681vY1hP19Jcj7DiBlWg2Kr5gvuZYYz2MoX3mnSl6qvRLn/d:TUdXOSieF681wX1T2eW1TpIzoGSoq5T1
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Erotica

SHA256 c8aa9d2cc4c486753227ea00bd3568c9678a909e1099f9fdf705beb9ba64c475
MD5 fe69f4e116c9132b49ec66d67d3f64cc
SHA1 9d362bc1228c86b500dccb296d612fb29f4e7e9f
SHA512 902d1742cb46d2523cc13c011cba23167d793e6eca2cda303128a42afb88b05fe43750685bdc16a3d0fd64e1fa12812e21a8d8cfb31102da3945636b78ac3d0e
SSDEEP 3072:Hi1oh4FLuEumfHAQGcIGbMKIad5LhIuaLa0v2n2gXMXE6U:Hi13umPl5bgadd2C0vmln6U
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Fcc

SHA256 66cc6b96d46d8c369d6e951b67714c8ad8c2f1709827288a78ea3743376727ef
MD5 f4307ff2131ec95b9dd5a0c45f196c29
SHA1 ed38a040db194ff1d1edd2c051b4f902b25676b0
SHA512 e67e803b3a7f80d380d38fc0ef560bf739bf8638826a5ee925bf9682199b443929b6307c988069b3c5192c871b287cc7f6e55e5c1322aa94940262423bad09d6
SSDEEP 3072:eoKkX3h77FmkvsPF/CFWiXtDl6o4OA7rKYQMndIxTXRl3IcfFzp+:3KaxFmkUmhpl6of2LxyxtlYctzs
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Fighter

SHA256 c0295eec5bce0536dd90812587235c1a3c20d8ff108f2849e7b29cc0a4d149bb
MD5 604438bac6f09b41497222019fc7f336
SHA1 7ca37d416a02a1531e349c332b6402ce70a6c335
SHA512 e8435c5f3e4a16cbf04e3f5eef2552d2c4c0dce506abeb65565bae7ca0b1258a8cff637805aa52954a257e7d3fcc90329d74faec2857dae7986380cc745f7e0d
SSDEEP 1536:Y1c+d9YUtq5YdzhtD4RLGki26nWRgRPaM60w9/5Sh4e:Yu+dVtqi/x4Rqf21Rgat0g/be
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Genre

SHA256 e080b81b3d074cd2d251cd260f87da91230f5203a419d300ceadff5829bdd865
MD5 2267fe956e0d39e1ab2eccfe04b31bff
SHA1 d69fe8c0b8221cbf59957ee9e5b6a3be4c3e08f4
SHA512 0f707a47bb9572613c1cd80c79720cb30687858b78ab6cc5c3dab5289abcc0a5b91d0083c142f9e41b5aea06ce389f826c03421bb0b857d16c7cd151aeb15965
SSDEEP 3072:9GR5yiPlcQ4NvoWV7a5ouYNqnLzAfaBaGdDqeb2Xo2IkVvh8p65E:6VPlcBgtoTqnvAfcaG9b2M8JTK
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Harrison

SHA256 78480ff8293882024b0e20f957e7604a39de2ce4b5d70abb2eceb74bab8e65a2
MD5 d0c075ad120c88f33eee07a7814febb6
SHA1 de3bb3be46cebdab8fab541c50a9139d22f250ef
SHA512 673301f1b74cd3ae08bdfce01113e4c134f40625d3b5a3024959ce1e1780d4d9e4fa272305ccc99ce276ad605568da924812e450ad2f03f25aec1c74c8784db5
SSDEEP 3072:qmd3ceTGQW+WGeqjjrh82L8SyEBB5VZwcxq2NXkivv+fUF3:JFdNWGeq/rh824AbZw1OXQ63
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Idea

SHA256 7c75d9a15afe2618191cbe6259fadbd08d8b887f737bc5fc0753c35143964c06
MD5 815d09d0c566620adb42951709c2566b
SHA1 70cf786174995f65953ec52744a601eb42596833
SHA512 362542da03fd6f6ddc405850f6ce586abd6fc40fde7008d285e626e70a4d834386a5f85806ede1240a4d9cddee48dd73d4b8e28a2b2626b42d64b6a819c3f182
SSDEEP 3072:QRay4UQQ6VXgYrm3zK7n7tr8PM+o2N88wWGeW3/o3:8ay4x7jVyM+o2TOw3
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Introduce

SHA256 e8d2991d51ee7a16d7accf154524f0cbabd31ab8a64f9ca20d7fd4c6e6fb6048
MD5 2c3507cb0f75c2a2383ae05a1b4da3f7
SHA1 cb61c374e2eb90a6fd6058dac329a2617762f4bb
SHA512 fd78e5fe0701436ceaeb852d4c5db25752a8b2bb3d3e5b6b4035d6a21c247bd3ee07c83da23fe6635ed76908204f9712d653bc6744b6491cf3bf9ec568990412
SSDEEP 3072:Dj+LFiEyLs0RxtoRU+5qkv2vvewDr81ue96zMx:Dqxgw7x
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Ld

SHA256 e96a15ed186802cf301cc991f2ed57767d4e09331dc594e78ea8abe11ab5d301
MD5 b921b408f48736eebac308b866b1548d
SHA1 1f61bc5a208a177d25f7b1faa44581894743e7c5
SHA512 bd5ed1d1ebc74f312b175e5db0585dc7c591484e90a3bf7e38fd62a54a2ebeacdb7a623c5d47cc4cc440288f16461cd464c46da5bc9e6cc5233ab8303cf49835
SSDEEP 1536:HklIusaAwu9hPx+l6JPTcUNx6/xhgariw:HEyaAt7P+6i/xhgariw
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Participants

SHA256 92f1df88e0467d0284f1de3e6d30bcf41b0ed56e055719872754627a2b4bb470
MD5 82a38745ff9cefa0859b47b8bd69f535
SHA1 6f97750b298ed3f3910e5aa4044b91e7409db9d2
SHA512 d22a5ddfacf8c00cde7c3fa27612ca386ae68f79b9c93b52d40be33d584eaf3c18b100da9ad6ba4efacef1cba4fa5d1665e4c3004454f0eb41c3051b98c60569
MD5 SHA1 SHA512

$INTERNET_CACHE/Pulse

SHA256 123df95eeda02992d35b1568195520400f7ae4a64bf50236e430a663e8129d88
MD5 5524b7a66d6d1848764c0b85bc099405
SHA1 2586d1b3d6d47a34d29a55a827ae3555ca4c0e46
SHA512 b569cf0d06982d8989562e71849a8f620db0e2232fe717de45c019fa632e6b1bf0b98a73bba19f2a45d14a95e761c883f943bc0a86402f6d5d430b07cc8292d9
SSDEEP 3072:TcHm/gIMi0RuOuN585dBN5GCtMor0Wo+7x9yK9h9Hw9JrUx7q10zDT5+YWKM9qGi:Zrqq6zD/2oGSvI4F7j1
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Que

SHA256 f758171942f43707f62d705a4fb68fcd79b954fc4f6b990a145d6483bf0aed9b
MD5 467692358edb5d7e7ac5d3eafda27e81
SHA1 44efb9c5fa0beb3aaa831828b741d9b67089ed32
SHA512 bf58d4fdce383990e7e96dd908ded78993f471c52a9a043bab9cc5c4ab2c1b71ca89de4761d184b253f1da55dff623b473fc136da7f8cfeb829774aa11a569ec
SSDEEP 1536:VLTN3EfrDWyu0uZo2+9BBVgCOa1ZBPaPQaEwo0yv:VLTNaWy4ZNoBVxjCPjojv
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Richmond

SHA256 8b134e57daf59418beafcbc7a767fb4c1c8bc8788a451df8db77db67be2bf4e6
MD5 8b1f0e8d35e983d56ed2185447cf3afc
SHA1 039e4e0ef8612367539e7e947c38687dd83cc776
SHA512 86d7f5a1ae76a27f3944baaa449afc95661c17a6f03b44edbdc599dc9b064545b61c64aea7e88a9eafdc2b90fde3bce54779c04599e48ad60c2a8e3a19d54638
SSDEEP 1536:cCV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkU5uG3xY5:cCV26MqgQTc5F446iYNpK5SB7BA
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Tuning

SHA256 b8121ff2602c62096bb986f45c76b809be1b402e7957304b21e484950c797074
MD5 91b4a23c348e1941d471c190a01beca0
SHA1 51e6ea0e49082f9b35fb586db261b1d383c3f043
SHA512 b52629fab0af07a5706afb88d2e2d1dca4633e20d65bb584cbe0c6b29e8e33230816bc771c98a2d5b2cbd9a3c3b0ac3912278f3ccc41013c2a8c0207c9d98032
SSDEEP 1536:LmgkwF1bEL8MzDigerQSm4mfQwMjki/PRy7H7Va7XHKIZowM4MCGqD+CHr8b/YaR:LmBmb63mWH8YfAOi1lwyaomd66CEf
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Violence

SHA256 7c2b2c850e82107982cc0abd0d0c46e7945f3c396a1f4760d4e23f3f3df28386
MD5 93ed87871a880028d0c02f5d5fada854
SHA1 0da924b87fb82dc8aa6251d88481cbd98c699c1c
SHA512 5fc212716d7d84643b2ce0190ca0b3abcbf366322f45b111beaa48febda2bc6421384805bc584f1d6027ff81cb16de9e0086ac7dea22c321d0a30d4d8470cbb7
SSDEEP 1536:ItrgWVrZ+In23SwFc1vtmgMbFuPO1MBNfMBNB+usWjcdGQI:maUAg0FuPOKBNEBNUG3
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Wx

SHA256 ceaa7b747db7429a9fd96dfd68fa0fc8e5161244d90a2bd11a547a6797ef0a57
MD5 b7ef61f258f06361024e6cf36449b1c2
SHA1 eff33dd0d5950a7d3362d150d2057904dc39b005
SHA512 174dd481c9891627c388a0ae9d4c5cb87e9a5ba6e11dd86ecdce11f2ca4480ebebb2c6904a51f48f953be137983a7b4579296d624f38fd02c051b6cdf1edf818
SSDEEP 3072:k8/Qe0W/nkpmOq+tY99VwtJYsbW0sfQqAl:n+W/k/pq9VOaqqYPl
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer