Loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Loader.exe
Size

561KB
MD5

106603ae8efbe7bce6d60ea3446d1d2c
SHA1

4b9759a148804f7249edf12a87d893bb818d6037
SHA256

6227f47fe696f66a5235740f1e97744a03e68039023202eefe47b5370b14364f
SHA512

15ad5c7eccea57bb3f4662845491c03d2249f87532ea9671f164a10fac3fef45d56a6d2c845c05779f03c275a71efa30bc057ff54c3bdd6aa985a4bc8a585d21
SSDEEP

12288:MOUcaxtZTmr2AGW+D9AAsLC+3d1Lzg78G7/thgeiSoALxhuh1:MORaxrTmSAGGFG+Ldw/thgeiSoALxu1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

Files

Loader.exe
.exe windows:6 windows x64 arch:x64

a7028e9d78bf75532ead4ef1bee8c10c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\user\source\repos\real\x64\Release\Loader.pdb

Imports

ws2_32

WSASetLastError
WSAGetLastError
ntohs
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACloseEvent
send
closesocket
WSACreateEvent
getsockopt

normaliz

IdnToUnicode
IdnToAscii

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

wldap32

ord60
ord50
ord41
ord22
ord46
ord27
ord32
ord33
ord35
ord79
ord211
ord26
ord45
ord217
ord143
ord30
ord200
ord301

kernel32

GetFileAttributesW
FindFirstFileW
FindClose
CreateFileW
GetFileAttributesExW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
GetLocaleInfoEx
FormatMessageA
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetModuleFileNameA
IsDebuggerPresent
GetCurrentProcess
WaitForSingleObject
CloseHandle
Process32First
WriteProcessMemory
lstrlenA
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32Next
GetProcAddress
VirtualAllocEx
CreateRemoteThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateEventA
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
Sleep
WideCharToMultiByte
GetLastError
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
GetCurrentThreadId
GetSystemTimeAsFileTime

user32

MessageBoxA

advapi32

CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
GetTokenInformation
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
CryptReleaseContext
CryptImportKey
CryptEncrypt

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memcmp
strstr
memmove
memchr
strrchr
strchr
__std_exception_copy
memcpy
__std_exception_destroy
memset
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_beginthreadex
__p___argc
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
system
terminate
_initialize_narrow_environment
__sys_errlist
_errno
__sys_nerr
exit
_c_exit
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
abort
_crt_atexit

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
realloc
_set_new_mode
_callnewh

api-ms-win-crt-stdio-l1-1-0

fopen
_close
_lseeki64
_fileno
fgets
fflush
ftell
fseek
feof
__stdio_common_vswprintf
_write
fclose
fputs
_read
fputc
__acrt_iob_func
_open
__stdio_common_vsprintf
__stdio_common_vsscanf
fwrite
__p__commode
_set_fmode
_fseeki64
fread

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

rename
_stat64
_unlink
_fstat64

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-crt-string-l1-1-0

strspn
_strdup
strncpy
strpbrk
strcmp
strncmp
strcspn

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoll
wcstombs
strtoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

Sections

.text
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7028e9d78bf75532ead4ef1bee8c10c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

normaliz

crypt32

wldap32

kernel32

user32

advapi32

msvcp140

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 425KB - Virtual size: 424KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 425KB - Virtual size: 424KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 2KB