loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

24.5MB
MD5

3a1579eb6146a9a5841149943d348c61
SHA1

241f11ba6859acacfed2ff6280fdf65e7326f74d
SHA256

9c3bbcce4c2548a81cd66d4c5c74c3fa70bfde118867f9141b2fc1534305b447
SHA512

c7a9de836abe51143d46bfd7f81aa19f67b1045c4465960549ccc981aa4d38b1ecebb4a7798202b3ea7a7d69871c79deaedb390b02393060b19450539e928b63
SSDEEP

393216:e4nIwuuAWostimTK2pghbYL4RJnlwHkh/7BBEofBo2dAyO:nnIGolm+2pghs4n+Kzu9yO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64 arch:x64

da11201a1226b15518b295c3a78f3ce6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

iphlpapi

GetAdaptersAddresses

cfgmgr32

CM_Reenumerate_DevNode

httpapi

HttpReceiveRequestEntityBody

kernel32

TerminateThread

user32

MessageBoxW

advapi32

RegCloseKey

ole32

CoInitializeEx

oleaut32

SysFreeString

ntdll

RtlVirtualUnwind

shlwapi

SHDeleteKeyW

wininet

InternetCheckConnectionW

dxgi

CreateDXGIFactory

setupapi

SetupDiDestroyDeviceInfoList

winhttp

WinHttpSetStatusCallback

bcrypt

BCryptCloseAlgorithmProvider

crypt32

CertFreeCertificateContext

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 28.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 27.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vtext0
Size: - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vtext1
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vtext2
Size: 24.5MB - Virtual size: 24.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da11201a1226b15518b295c3a78f3ce6

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

cfgmgr32

httpapi

kernel32

user32

advapi32

ole32

oleaut32

ntdll

shlwapi

wininet

dxgi

setupapi

winhttp

bcrypt

crypt32

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 28.0MB

.data Size: - Virtual size: 27.9MB

.pdata Size: - Virtual size: 46KB

_RDATA Size: - Virtual size: 244B

.vtext0 Size: - Virtual size: 6.3MB

.vtext1 Size: 512B - Virtual size: 312B

.vtext2 Size: 24.5MB - Virtual size: 24.5MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 28.0MB

.data
Size: - Virtual size: 27.9MB

.pdata
Size: - Virtual size: 46KB

_RDATA
Size: - Virtual size: 244B

.vtext0
Size: - Virtual size: 6.3MB

.vtext1
Size: 512B - Virtual size: 312B

.vtext2
Size: 24.5MB - Virtual size: 24.5MB

.rsrc
Size: 512B - Virtual size: 480B