loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

loader.exe
Size

13.9MB
MD5

01f0189dccb356717622dba4801568d8
SHA1

c0a413e11c4f1ff78a56455e42864b7ca3127691
SHA256

bf5acd89c2c463cf434efc987c03c78b43234765ec3df0a872bfbc8d0cc2e602
SHA512

5cdcd65c68fbad3a71996f2e2be6b382bd1525ca37a1f9d57084c182cf002bc8f520652ca981cf678afd40a3a5416ac9cd86d536347360b87bee3899e22b3b60
SSDEEP

393216:XCV5MpVkmrv5udnitEscwyXM9M4JhHb4Al:XWMoW8itEsHiubTl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

Files

loader.exe
.exe windows:6 windows x64 arch:x64

9424dfb6e3bb762ecb6fd31599264ca4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\sasaz\Documents\GitHub\web\loader\binary\Production\loader.pdb

Imports

iphlpapi

GetAdaptersInfo

kernel32

GetCommandLineA
CreateProcessA
DeleteFileA
GlobalMemoryStatusEx
GetProcessHeap
HeapAlloc
CreateFileA
GetLastError
DeviceIoControl
HeapFree
GetSystemFirmwareTable
GetSystemTime
CloseHandle
Process32Next
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetCurrentProcess
Process32First
FormatMessageA
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesA
GetConsoleMode
Sleep
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
HeapReAlloc
GetExitCodeProcess
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineW
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
ReadFile
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
SetStdHandle
GetTimeZoneInformation
GetDynamicTimeZoneInformation
WriteFile
WriteConsoleA
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateProcessW
ExitProcess
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlLookupFunctionEntry
WriteConsoleW
RaiseException
SetEvent
ResetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
SetUnhandledExceptionFilter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
CreateThread
TerminateThread
GetProcessId
VirtualQueryEx
FreeLibrary
LoadLibraryW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
WaitForMultipleObjects
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
GetModuleHandleW
GetEnvironmentVariableW
GetModuleHandleExW
VirtualProtect
VirtualFree
GetACP
GetSystemDirectoryA
LoadLibraryA
GetSystemTimeAsFileTime
SetConsoleMode
ReadConsoleA
ReadConsoleW
FindClose
FindFirstFileW
FindNextFileW
QueryPerformanceCounter
QueryPerformanceFrequency
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind

user32

EnumDisplayDevicesA
MessageBoxW
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
CryptEnumProvidersW
RegSetValueExA
RegOpenKeyExA
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptSignHashW
RegDeleteKeyA
ConvertSidToStringSidA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
OpenServiceA
RegDeleteTreeA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA

ntdll

RtlVirtualUnwind
RtlInitAnsiString
RtlFreeUnicodeString
RtlCaptureContext
RtlNtStatusToDosError
RtlAnsiStringToUnicodeString

bcrypt

BCryptGenRandom

ws2_32

gethostbyname
ntohs
getsockopt
freeaddrinfo
getaddrinfo
socket
setsockopt
ioctlsocket
connect
WSAGetLastError
htonl
recv
closesocket
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSASetLastError
WSACleanup
WSAStartup
select
__WSAFDIsSet
shutdown
htons
inet_addr
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
send

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wininet

InternetOpenW
InternetReadFile
InternetQueryDataAvailable
InternetSetOptionW
HttpOpenRequestW
InternetCrackUrlW
InternetConnectW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetCloseHandle

Sections

.text
Size: 12.6MB - Virtual size: 12.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9424dfb6e3bb762ecb6fd31599264ca4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

kernel32

user32

advapi32

shell32

ntdll

bcrypt

ws2_32

crypt32

wininet

Sections

.text Size: 12.6MB - Virtual size: 12.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 29KB - Virtual size: 54KB

.pdata Size: 139KB - Virtual size: 138KB

.fptable Size: 512B - Virtual size: 256B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: - Virtual size: 40KB

.text
Size: 12.6MB - Virtual size: 12.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 29KB - Virtual size: 54KB

.pdata
Size: 139KB - Virtual size: 138KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: - Virtual size: 40KB