loader_base[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

loader_base.exe
Size

313KB
MD5

a760b71330bfedd181c6774033d91e82
SHA1

78a07f7fbef0fa37041025f3071abf588aa25255
SHA256

fe4bf79d07412ae23d92a354eedcf5c89b13184ead8f9c8c4ffc29593728ec8b
SHA512

90794a5547e38c35574545b51fb2eae107ff0459608e7ce1653e37396e1eaa972648ee57dbc4a50a102132ff3af3024822ddeaf74b1f5d4fd1b25cd74cf72053
SSDEEP

3072:kOWWEjWlCN5+x/U4j4e//94bPzlOVLZJWo481EBucT0n6Hdf:PfrD4e94s5dcT0Idf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader_base.exe

Files

loader_base.exe
.exe windows:6 windows x64 arch:x64

a03d0106d0d591126ab8839ad12a2096

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\PC\source\repos\loader base\x64\Debug\loader base.pdb

Imports

kernel32

WaitNamedPipeW
GetCurrentProcessId
GetModuleFileNameW
lstrlenW
MultiByteToWideChar
GetStdHandle
Sleep
GetConsoleMode
SetConsoleMode
SetConsoleTextAttribute
PeekNamedPipe
SetCurrentConsoleFontEx
GetConsoleWindow
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
GetLastError
CloseHandle
WriteFile
ReadFile
SetConsoleTitleA
CreateFileW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
RaiseException
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentThreadId
GetProcAddress

user32

SetLayeredWindowAttributes
ShowScrollBar
GetWindowLongA
SetWindowLongA
GetWindowLongPtrW
MoveWindow
SetWindowLongPtrW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

shell32

ShellExecuteA

msvcp140d

_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_init_in_situ
_Cnd_broadcast
_Mtx_unlock
_Mtx_lock
_Mtx_current_owns
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_destroy_in_situ
_Thrd_id
_Thrd_join
_Query_perf_frequency
_Query_perf_counter
_Xtime_get_ticks
_Cnd_timedwait

urlmon

URLDownloadToFileA

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

vcruntime140d

__C_specific_handler_noexcept
__vcrt_LoadLibraryExW
__std_exception_copy
memset
memmove
__vcrt_GetModuleHandleW
memcpy
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
__current_exception_context
__C_specific_handler
__current_exception
_CxxThrowException
__std_exception_destroy
memcmp

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
_configure_narrow_argv
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_free_dbg
_wmakepath_s
_wsplitpath_s
wcscpy_s
_seh_filter_dll
getenv
malloc
_beginthreadex
_time64
strlen
strcmp
terminate
_CrtDbgReport
free
_invalid_parameter
__stdio_common_vfprintf
__stdio_common_vswprintf
__acrt_iob_func
_wassert
_callnewh
_CrtDbgReportW
setlocale
_initialize_narrow_environment
__p__commode
system
wcscpy

Sections

.textbss
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a03d0106d0d591126ab8839ad12a2096

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

msvcp140d

urlmon

ntdll

vcruntime140d

vcruntime140_1d

ucrtbased

Sections

.textbss Size: - Virtual size: 88KB

.text Size: 211KB - Virtual size: 211KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 1KB - Virtual size: 266KB

.pdata Size: 18KB - Virtual size: 17KB

.idata Size: 10KB - Virtual size: 9KB

.msvcjmc Size: 2KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.textbss
Size: - Virtual size: 88KB

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 1KB - Virtual size: 266KB

.pdata
Size: 18KB - Virtual size: 17KB

.idata
Size: 10KB - Virtual size: 9KB

.msvcjmc
Size: 2KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB