loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

2.2MB
MD5

d97d23c6624b3b18f5fdf788d16a6239
SHA1

334039bd166717a026342e8feb853d511207bcc2
SHA256

4cc39ca14a8913456f7f6bedcdfcf849534ff519d6a21a66af71c4a8f08585f5
SHA512

00e212770a9fbb1294a437eec3582ed536ce893f5eabe7a2b78338a8373d354a3275b4c225d4955f06efb8fc18400c6995a47a4df2dce32ec7574dd33c1a6040
SSDEEP

49152:gGXlght/F/s33837/9IqttdVkbXFtmpDlhuhcKgxVhqWocqA0l5Ws:e/F/sHakbXFtmpDlh+cDxrqRD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64 arch:x64

77d0a34e00e9797b99edcf6225a4b772

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\david\CLionProjects\Loader\cmake-build-release\loader.pdb

Imports

opengl32

glViewport
wglDeleteContext
glClearColor
wglCreateContext
glClear
wglMakeCurrent

ntdll

RtlAllocateHeap
NtQuerySystemInformation
RtlFreeHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlVerifyVersionInfo
NtQueryInformationProcess
VerSetConditionMask
RtlUnwind

ws2_32

accept
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htonl
WSACreateEvent
htons
listen
ntohl
ntohs
recv
select
send
setsockopt
shutdown
socket
gethostname
getpeername
sendto
recvfrom
WSAIoctl
inet_ntop
inet_pton
WSAGetLastError
WSASetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSAStartup
WSACloseEvent
getnameinfo
freeaddrinfo
getaddrinfo
WSACleanup
__WSAFDIsSet

bcrypt

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGenRandom
BCryptGetProperty

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt

crypt32

CryptBinaryToStringA
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

kernel32

SetEndOfFile
FreeLibraryAndExitThread
ExitThread
SetFilePointerEx
ReadConsoleW
GetConsoleMode
CreatePipe
SetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
CreateProcessW
ExitProcess
WriteConsoleW
GetModuleHandleExW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
InitializeSListHead
SystemTimeToFileTime
WriteFile
GetConsoleOutputCP
HeapFree
OutputDebugStringW
HeapAlloc
FlushFileBuffers
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
RemoveDirectoryW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
Sleep
GetLastError
GetModuleHandleW
ReleaseSemaphore
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
GetCurrentDirectoryW
CreateSemaphoreW
CreateEventA
SetLastError
OpenProcess
VirtualAllocEx
GetExitCodeProcess
CreateProcessA
GetModuleFileNameW
GetTickCount64
GetEnvironmentStringsW
ReadFile
GetFileSizeEx
CreateFileW
MultiByteToWideChar
GlobalAlloc
GlobalLock
WideCharToMultiByte
GlobalUnlock
WriteProcessMemory
GetModuleHandleA
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GlobalFree
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameA
GetLongPathNameW
DuplicateHandle
SetHandleInformation
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
TerminateProcess
GetCurrentThread
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetVersion
IsWow64Process
CopyFileW
MoveFileExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
InitializeCriticalSectionEx
CreateEventW
GetSystemDirectoryW
LoadLibraryW
FormatMessageW
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
FreeEnvironmentStringsW
GetCurrentProcessId
SleepEx
VerifyVersionInfoW
SetEnvironmentVariableW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileInformationByHandleEx
AreFileApisANSI
SetFileTime
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
FindFirstFileExW
TzSpecificLocalTimeToSystemTime
GetProcessHeap
HeapSize
GetCurrentThreadId
WaitForMultipleObjects

user32

GetKeyState
ScreenToClient
GetMessageExtraInfo
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
GetCapture
LoadCursorA
ReleaseDC
UpdateWindow
PostQuitMessage
TranslateMessage
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
GetClipboardData
DefWindowProcA
GetForegroundWindow
PeekMessageW
DispatchMessageW
IsWindow
ShowWindow
RegisterClassExW
UnregisterClassW
CreateWindowExW
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
SystemParametersInfoA
GetWindowThreadProcessId
AttachThreadInput
BringWindowToTop
GetClassNameA
GetWindowTextA
EnumWindows
WaitForInputIdle
MessageBoxA
DefWindowProcW
GetWindowRect
DestroyWindow
GetDC
IsWindowVisible
MessageBoxW

gdi32

SwapBuffers
ChoosePixelFormat
SetPixelFormat

shell32

ShellExecuteExA

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocString

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imain
Size: 512B - Virtual size: 27B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.iseh
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itls
Size: 512B - Virtual size: 101B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77d0a34e00e9797b99edcf6225a4b772

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

opengl32

ntdll

ws2_32

bcrypt

advapi32

crypt32

kernel32

user32

gdi32

shell32

ole32

oleaut32

imm32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.imain Size: 512B - Virtual size: 27B

.iseh Size: 512B - Virtual size: 69B

.itls Size: 512B - Virtual size: 101B

.rdata Size: 720KB - Virtual size: 720KB

.data Size: 26KB - Virtual size: 36KB

.pdata Size: 61KB - Virtual size: 61KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.imain
Size: 512B - Virtual size: 27B

.iseh
Size: 512B - Virtual size: 69B

.itls
Size: 512B - Virtual size: 101B

.rdata
Size: 720KB - Virtual size: 720KB

.data
Size: 26KB - Virtual size: 36KB

.pdata
Size: 61KB - Virtual size: 61KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 6KB - Virtual size: 5KB