RebornLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RebornLoader.exe
Size

5.2MB
MD5

2dd1d52b6372153a130df7c7cb034e29
SHA1

7d0a0fadf11dfcc9f2aba93e646e236ab142aa09
SHA256

b3924c68ccd49de4eecaad165a94c2f73d3a5fdc6d32b65c97c76816d33f4f7e
SHA512

3ce9ebbb419c4778d212929e036d54362e84a0b77de37f0b01f8ba45cd248dc2cb51c0598d40e97633b3d2aa17a4d455bbc606332d148b78a2652d9871be69e7
SSDEEP

98304:ka6XZetPH1VE7HlqFHZBvK8gtg/5nG6p3zYIAC6dcXwPHXlH3smqW9j2EA8:L6XZetPHcGHZBnn5nGmzYfCHAfV85WpB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RebornLoader.exe

Files

RebornLoader.exe
.exe windows:6 windows x86 arch:x86

46e5bbd04cf200c45935784b05e1c94c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow

urlmon

URLDownloadToFileA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-file-l1-1-0

GetFileSize

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileA

api-ms-win-core-memory-l1-1-0

VirtualAllocEx

api-ms-win-core-registry-l1-1-0

RegQueryValueExW

api-ms-win-core-processthreads-l1-1-0

OpenThread

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-toolhelp-l1-1-0

Process32NextW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError

shell32

SHGetSpecialFolderPathA

user32

UnregisterClassW

kernel32

Module32FirstW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

CoInitialize

imm32

ImmSetCandidateWindow

msvcp140

?always_noconv@codecvt_base@std@@QBE_NXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct

wininet

InternetGetConnectedState

vcruntime140

_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

strtof

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

Sections

.text
Size: - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 804KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.V3Y
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Ilq
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.y-K
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46e5bbd04cf200c45935784b05e1c94c

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dx11_43

d3dcompiler_47

dwmapi

urlmon

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

shell32

user32

kernel32

ole32

imm32

msvcp140

msvcp140_atomic_wait

wininet

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

Sections

.text Size: - Virtual size: 372KB

.rdata Size: - Virtual size: 71KB

.data Size: - Virtual size: 804KB

.V3Y Size: - Virtual size: 2.7MB

.Ilq Size: 2KB - Virtual size: 2KB

.y-K Size: 5.2MB - Virtual size: 5.2MB

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: - Virtual size: 372KB

.rdata
Size: - Virtual size: 71KB

.data
Size: - Virtual size: 804KB

.V3Y
Size: - Virtual size: 2.7MB

.Ilq
Size: 2KB - Virtual size: 2KB

.y-K
Size: 5.2MB - Virtual size: 5.2MB

.rsrc
Size: 7KB - Virtual size: 7KB