loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

27.3MB
MD5

af259a7846b87c0b289542ac2645b912
SHA1

36509d4a38016d27ba2d13c4473cbe2401c7c765
SHA256

c9167561574f88d0ec8895eebca83baf489d367d7bbdc3064efee0e6568840aa
SHA512

9eb16ab33fa652411d0a258196255ccb49fc78ea2d9893c7bc598ac8b326fc71361380dc1317948601cea81051dc797ae19d3528ae6082d0e2cb3eb4c86313b6
SSDEEP

393216:2+Y739YRS+LLCCHGvyG5M7xWYTDc2iVrpPdmYhRv5PEsl5OE41pZYwh9vMQVRN8g:27NYRDL0ENWY82i/0YhRvBEsHMh11c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64 arch:x64

da11201a1226b15518b295c3a78f3ce6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

iphlpapi

GetAdaptersAddresses

cfgmgr32

CM_Reenumerate_DevNode

httpapi

HttpReceiveRequestEntityBody

kernel32

TerminateThread

user32

MessageBoxW

advapi32

RegCloseKey

ole32

CoInitializeEx

oleaut32

SysFreeString

ntdll

RtlVirtualUnwind

shlwapi

SHDeleteKeyW

wininet

InternetCheckConnectionW

dxgi

CreateDXGIFactory

setupapi

SetupDiDestroyDeviceInfoList

winhttp

WinHttpSetStatusCallback

bcrypt

BCryptCloseAlgorithmProvider

crypt32

CertFreeCertificateContext

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 31.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vtext0
Size: - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vtext1
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vtext2
Size: 27.3MB - Virtual size: 27.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da11201a1226b15518b295c3a78f3ce6

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

cfgmgr32

httpapi

kernel32

user32

advapi32

ole32

oleaut32

ntdll

shlwapi

wininet

dxgi

setupapi

winhttp

bcrypt

crypt32

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 31.1MB

.data Size: - Virtual size: 30.9MB

.pdata Size: - Virtual size: 46KB

_RDATA Size: - Virtual size: 244B

.vtext0 Size: - Virtual size: 6.3MB

.vtext1 Size: 512B - Virtual size: 312B

.vtext2 Size: 27.3MB - Virtual size: 27.3MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 31.1MB

.data
Size: - Virtual size: 30.9MB

.pdata
Size: - Virtual size: 46KB

_RDATA
Size: - Virtual size: 244B

.vtext0
Size: - Virtual size: 6.3MB

.vtext1
Size: 512B - Virtual size: 312B

.vtext2
Size: 27.3MB - Virtual size: 27.3MB

.rsrc
Size: 512B - Virtual size: 480B