loader[.]exe | Triage

Resubmissions

05-07-2024 13:28

240705-qqzg4sygmm 8

05-07-2024 13:24

240705-qnc64ayfrk 8

Sharing

Copy URL

Twitter E-mail

General

Target

loader.exe
Size

14.3MB
MD5

abcf10d799268fe2583915def8bc40d6
SHA1

7ed492e40499c2c5cf3b5b0286ad16b743dcb27f
SHA256

0bfa52c77ec71cca4dcda293482e5d5917f92f5219cbc52bc7aff30ee6cca3f3
SHA512

e7afb50d851914f7e9d89c03ba24f2a7d0fcab90258d975bd485050f2cca87338141719cc3741293237570b443e5de724a96407e57114257465abb575d607003
SSDEEP

196608:urCkQo6RyNCgDkMFhv7rJ15IiAeM2EmVDh5rd0q7rzI83wEnHt0NWklylyHL:SCZTEDkA97rJ1eiAUEwDnmqjIn0qy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64 arch:x64

d8c2cfb2a414f3456f5a1bd5afc13730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

PeekNamedPipe
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

RegisterClassExA

gdi32

GetDeviceCaps

advapi32

CryptGenRandom

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow

msvcp140

_Cnd_do_broadcast_at_thread_exit

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

normaliz

IdnToAscii

wldap32

ord33

crypt32

PFXImportCertStore

ws2_32

accept

shlwapi

PathFindFileNameW

rpcrt4

UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-locale-l1-1-0

localeconv

Sections

.text
Size: - Virtual size: 810KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.YG]
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.h9t
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.13<
Size: 14.3MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

d8c2cfb2a414f3456f5a1bd5afc13730

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

imm32

msvcp140

d3d9

d3dx9_43

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 810KB

.rdata Size: - Virtual size: 276KB

.data Size: - Virtual size: 96KB

.pdata Size: - Virtual size: 31KB

.YG] Size: - Virtual size: 8.3MB

.h9t Size: 5KB - Virtual size: 5KB

.13< Size: 14.3MB - Virtual size: 14.3MB

.reloc Size: 512B - Virtual size: 304B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 810KB

.rdata
Size: - Virtual size: 276KB

.data
Size: - Virtual size: 96KB

.pdata
Size: - Virtual size: 31KB

.YG]
Size: - Virtual size: 8.3MB

.h9t
Size: 5KB - Virtual size: 5KB

.13<
Size: 14.3MB - Virtual size: 14.3MB

.reloc
Size: 512B - Virtual size: 304B

.rsrc
Size: 512B - Virtual size: 480B