windows_shellcode_loader[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

windows_shellcode_loader.exe
Size

1.9MB
MD5

71eb0dacf8cc3a5f28f97a3118617ba3
SHA1

a44ec48144e6324efb253ae1df0308fbb245ab3c
SHA256

bb4be945dc877db16d2e377d95b6f6ef09511704f87d7e42eb65079db9cf5bbd
SHA512

a370fd93672b41e2c3d45735709da921702d2c16a2124c2e6d3635a1848b63c69d6d164f681f69460b004496bb655ffc8a68e68162a8e4655611e2af87f761c0
SSDEEP

49152:MiIOBlFN+jcg72yasRc6lBH1KroUbRZPAi4IU6ibV:AagiypuuQb8iH+bV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
windows_shellcode_loader.exe

Files

windows_shellcode_loader.exe
.exe windows:6 windows x64 arch:x64

27021d6e8e87c3608b8d59580bc1ee86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

windows_shellcode_loader.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

OpenProcessToken
SystemFunction036

kernel32

UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
TerminateProcess
GetProcessHeap
HeapFree
GetCurrentProcess
CloseHandle
VirtualAlloc
VirtualProtect
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
HeapReAlloc
GetLastError
GetSystemTimePreciseAsFileTime
SetLastError
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
lstrlenW
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetEnvironmentVariableW
GetModuleHandleA
CreateWaitableTimerExW
SetWaitableTimer
Sleep
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
ReadConsoleW
SetHandleInformation
CreateThread
ExitProcess
QueryPerformanceCounter
HeapAlloc
GetCurrentThreadId

shell32

ShellExecuteA

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile

ws2_32

WSASocketW
getsockopt
setsockopt
recv
WSACleanup
WSASend
getpeername
getsockname
WSADuplicateSocketW
send
connect
accept
ioctlsocket
select
WSAStartup
getaddrinfo
closesocket
WSAGetLastError
listen
bind
freeaddrinfo
WSARecv

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
memmove
memset
memcpy
memcmp
__CxxFrameHandler3
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_initterm_e
__p___argc
__p___argv
_cexit
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_c_exit
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 637KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27021d6e8e87c3608b8d59580bc1ee86

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

shell32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 637KB - Virtual size: 636KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 38KB - Virtual size: 37KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 637KB - Virtual size: 636KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 38KB - Virtual size: 37KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB