Load[.]exe | Triage™

resource
Load.exe
unpack001/$PLUGINSDIR/nsExec.dll

Load.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 7d535ced79cd715cc19958b60bf36c8c1767512badbe52cd5de772794343f891
MD5 85a6255db6f91e55ae555765ddf6da3c
SHA1 d65b6d1bdc2d714ca42332f25e1016a9f51bd3d1
SHA512 2ed6ce51f0b28b83c008d7fe7d7335de00da946892d7b9ad8716f24058d193e718a80085794d6128fee827a9156307014c7adfbf1527034b757803ce24f23679
SSDEEP 49152:WeVM0iS5rPZhlDRGfyaH261Bx9Rd8FBWz3u:5M0iS5fv/aT/RufWru
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Cold.accde

SHA256 1372597e13587b45288c9fae08655acf609f23cba5eec57938b6b8c9f38f3bbe
MD5 b43eb45f268429a0fcab1af9740a9fcd
SHA1 a324d83c6f0596af67fd4bd63e7ce8371fd04512
SHA512 ba94503e346ab71ab300aa989f74ad4896a6df2a03da6820ba8341e3952db4a81005f1f437e8c53b0d0981aa44c0e5929efdf3cf291b063555f61274d50fb68b
SSDEEP 6144:EWJLt8VubrnORduW5dL+C+g90I6LeQGSCe5A3Exez1b:H1Rbrnir5N+nLeQL5kExel
MD5 SHA1 SHA512 SSDEEP

$TEMP/Cumshot.accde

SHA256 cb695127d5c327106254c73f386b11c8ec27aca7d931a8a6f3d7df03833e1ea4
MD5 9d18169160b65dbc5490b0d30cfb10cc
SHA1 d309d5d7b0572ba1eb2ecad3f9c638b59bae49b7
SHA512 9472401f61a99c0eb53ce39e886b6778754d0435189c4ee53d8d9839493af5005777f83bcd3fb76ac854aaf8f4389248011d51d0a5a666d3d9fea07c3059167a
SSDEEP 6144:haR2CyCyveTgdqWG2WauBETyXNS+udGtzqjK:haR2WZTtWx6BET2S+ud2z/
MD5 SHA1 SHA512 SSDEEP

$TEMP/Else.accde

SHA256 ab24e3374bc2ea8a215fcb0d08d028e24d0e52dedcb20e2bd6b1878ed9262a33
MD5 0a30e1828bab8563f43eaa206f62f729
SHA1 4dabbf95d9cf114498b94072a7b0b7dc462b3095
SHA512 32d43a6959b58f52267405e87acff00fd5586d3ddbc0505dff2bdf27070057eb9c4a893beb3fee67d2f3d448562a510cf13d8f002f3e70eed8c4354dea08a83e
SSDEEP 1536:mkW+BRcR2JvxxDQTUa0j4hD08MExK97J3mV9RvUp1hdTFJAQLg51b6HGtgM1BQIQ:/RvxlanR9xK97J3i3cB3LgSHGOM1RYmw
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ot.accde

SHA256 e88a7616e0e3a6323a2093918adce82bc86b5866d96cc935bda80d89a4f1b275
MD5 9883558bae65366e6ca2e0b3ac836d73
SHA1 23c3a4e32483b01d35fde866115ead71b70d22c4
SHA512 66847303754791460c2ea4d69508e6316a4577650e6313c968166d47cf11677d3e360b602be66355032105e1e48a5162934ea358e1b91a1040fec2a29c7297c8
SSDEEP 6144:/46xnY6P0nKOhwy28SlBW1GeTRUzvivKvjE5Cge/2PKf35mKFkE4q:/nTeKOO9Dy1vEGdO5mcB
MD5 SHA1 SHA512 SSDEEP

$TEMP/Pills.accde

SHA256 4f01d72b47630324ba241daff69d1215883bea0fdc46ef711638e60ff0df8703
MD5 9abf97936b0e4194aec3c472a6c0718b
SHA1 d70271905125085140fce9c577adfaabfe79bc21
SHA512 a61cfe75c888f9fc56ec2c6bdf779936e2d2e043c35649d3599c2cab4b6c6e5335835443712a28f1c7ba09f694780f1bd65f269cfbc51bebe56531a726b0b332
SSDEEP 768:5rik9xetXUwmuX9rRo2AOgkK/954+G7KTAsc7:dzxo0q4/9gmTAsM
MD5 SHA1 SHA512 SSDEEP

$TEMP/Sensitive.accde

SHA256 630dda8c2c54e655e6aee85c157f900ec660d4f3f734c84b1fccbd04dcde4cfa
MD5 bafd36e9c357a1b96ab73a6248768843
SHA1 22e8d9cd3c7936dd92904ff157686f5ab40696b0
SHA512 59d15ab7f4c72b1b44c4ad1f8c0289f7be25834f2b543ef05147f39cae15e37b244a6a173d9f68f223bb7fa448411f130d20a1c8e38391c68d87a29921260fda
SSDEEP 3072:v5IDOsRCJL+VWtxv06VwTx/5OvASz9nRgrBNMQ5XCu+FHg30XHwlgQzBpuYbmJPf:v5xsRCuiuW9RDQIul0g9Bbbmxf
MD5 SHA1 SHA512 SSDEEP

$TEMP/Spank.accde

SHA256 34972e6d9b720d1a745613d457c6a1fa77859d1f087e43563f82f16c607cf669
MD5 fb2b2c24485e210b167cd12c8244d745
SHA1 ec67d9868bfd1ed877009fcc42377e5b9171ee33
SHA512 96be195bd30172bf0ce3623098f2f6194332c68afc4fc1356bb5ee3a95a86c5d0190d811a686cf83af08e3b3ffbae7b5aa48845579884c55ee6e5923d193735a
SSDEEP 12288:bz67JjkPxwDYv/GKFSJf5tO4rkZQmm0/bMKD9irfV15:PGDYGWO5Ml4KDCfV15
MD5 SHA1 SHA512 SSDEEP

Agreed

SHA256 a7ac0ffb47ca19c3fabadbddc4f63463a62a44319a2ddfdf78c0e8cfad96f2dc
MD5 c2c53fed06e5b28310a66c4016f522c0
SHA1 fe3fbbbc63c63e3a2e520b29e2504dbae4994faa
SHA512 3330647bd95a34343cd4d4c169228c43898cc3818c5bf47eb6f0c2280b853388b624ba055df4bf4a24b5e374bc8ab9bf843cef7beab6c70d16602aaa788fcdb1
SSDEEP 384:Hdv3C3C/u2WuFRQNv1/yJnfKVWVFTwWdGBkSZ:9vSb2Tal0xiVWV9+k
MD5 SHA1 SHA512 SSDEEP

Area

SHA256 742f938765052aeb6f36f3d70a56664e35f9139e1ee88e608415e26c8761059f
MD5 4e3c7329a95460384c3207b5e4d9722e
SHA1 057c79aefb45c3b2aa5edef61f513a734493b254
SHA512 25ec0c73278e896bda8975adf578d150e0b69ef642ee099fce92d1f182be645e316705a0ce0b5b9e27e1c7f09011071d339bef1408f3eaa265c4250bff0aeb49
SSDEEP 1536:J1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3op:J1Pfam6OzmkrJrRj4p
MD5 SHA1 SHA512 SSDEEP

Bobby

SHA256 f57c8551521636d24bdd6083e814b7218c9f46ca74040cca525a4eb039099fdb
MD5 19e71a975b0c97ea503317528c269f5e
SHA1 43f6496f67879080faea026111cd5e2af566a7de
SHA512 c2e0c124e3b9b059c7610d6a9711303c600fabc790395afcc980d82bcbf64ae444cd7be1a3174ad4ad52bec1700fb4b0478449ad8a70787b1f68224f31692313
SSDEEP 1536:EYwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xe5c/o:EeVzOqD1IGuTpMgKYbwR5Exe2/R+
MD5 SHA1 SHA512 SSDEEP

Coalition

SHA256 88a67db6cb700d6ef206d755ff9c768e26eb9cd362e81b5fa014b9ac91ae5e60
MD5 fb57462777803a903e855da398c19f16
SHA1 a4931d0aea3e718d902174e5875e24e576df816d
SHA512 1d8e950959f6f7bbc8021472505de3f849ef4c72c1642b077871f0f22f9090bf6c86855b38d64f2893e9d511404fde15fd72213caddcb617057dcd5bbebda6a8
SSDEEP 3072:fgz8StjOrOJGGMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtZ:G8StQOAGlXuww8x1WUE
MD5 SHA1 SHA512 SSDEEP

Hash

SHA256 2a6d5bfe78df57e46943b0afdfdcbed60d4036ecfcbb5fdb5946d40122656bc4
MD5 89a85cafad483e01a5c264d001045e61
SHA1 fbe7b9343bd0a405cdb807f9549868468fe4566d
SHA512 052460966022541ff2202795ff85717b09dcfd92639309d53922bd57a2dbbaa9c5b55aac4e756ddd500c1445b695e92db1f3098f36139d9c7d83efc7697e4cd2
MD5 SHA1 SHA512

Hk

SHA256 b85c84acdd28baee22efbfd22a073c0d67ec7d08ba98db6e34ffe58322bc11b4
MD5 774a0c0621a72fdfbd3a056773404914
SHA1 992e2a19ebd83a6c9258c27f141a515a51a29c09
SHA512 1f97300acfd76a73251101aab94d84b05b2b7da22bf6633880fdf85a24ca0d7ca06e5b251e17f1edf39acd6c26e7a93e2936b70be81fc8d44a36f57fe02a34f7
SSDEEP 3072:CX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8jS:CggXuN2KFIyt+8ZUlhxb8AS
MD5 SHA1 SHA512 SSDEEP

Madonna

SHA256 716377726aa94402d76302f7a3cf40cf55b44cac615a3f815d53519ff2bef9fc
MD5 b37ddc4681e3e6dff9af3ce83266af23
SHA1 a17face06fc73bad2aeec222f3b62799d0e6b8ec
SHA512 433be2460c0dcc91a3b8f52fda2cdd70ec05906430eddd639b7599ba042eeff334e41e388c1887eea6f455f6137ef963b992602a09e654b2db2133a23a661bcd
SSDEEP 1536:/63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7Dj9:/6DWy4ZNor+D62rqd2iXx
MD5 SHA1 SHA512 SSDEEP

Managed

SHA256 6f0c2b13525b6159062570ec52d3408283705894d9a43ae6c4fa2bd42f33202e
MD5 a9a9a4183b73467c421f9833015e8347
SHA1 0a6e8fa46a6670eef57906a243fcfc6efbe18c7a
SHA512 31745364ce36636292edc5bd1fcfd71ef3d1523a72a73151daefebc6d74b379f2694e8c9f658724b8a5fdf86450f42f3ec9d98b6a7922ee870b1d82f0eda0af6
SSDEEP 1536:kJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsbI:kJ8lghHzJi2ubSW4wC2mYR+H6
MD5 SHA1 SHA512 SSDEEP

Martial

SHA256 faa15dcc87f16b6f6aba48a679128c5d309caa85d2c42c8d339c52a010e856eb
MD5 5ee4d39f1bf532637e58769878e3b30d
SHA1 27ef05d84ed968dff5ae0f799b96f46a1932b109
SHA512 bb75be53652dfecbaacabcd85f49e1c57f582fb778c66579771ef695b38f5d396f07f833473058b642216b9d4641759c06b81d7726afdcc7c5bd25766445a58f
SSDEEP 1536:iyAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvD:DDXOXT/CfXib+tSijpcVMFXD5ypAXoQ
MD5 SHA1 SHA512 SSDEEP

Write

SHA256 2aa6f41e069312a6ca1f774cde797c17f61b5433ba9cfbf055055fec4f3ec501
MD5 61179ad38ee528f8f5efa1debcc6c2e8
SHA1 3207818441b41057477e1ca00500bd0cd9ccaf22
SHA512 7d50765997ca56acdb2d33876851ac02c053c72c31100422996ef1fa5d4f9bc7d4317ca2768525e2185032173aad16c5b0bbf2ed653b8c9639fa5a74141af1a9
SSDEEP 3072:ZRVB4Y3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAtQ:1B4Y3IW5Iuh0AOz04p1dm
MD5 SHA1 SHA512 SSDEEP

Load.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cold.accde

$TEMP/Cumshot.accde

$TEMP/Else.accde

$TEMP/Ot.accde

$TEMP/Pills.accde

$TEMP/Sensitive.accde

$TEMP/Spank.accde

Agreed

Area

Bobby

Coalition

Hash

Hk

Madonna

Managed

Martial

Write

Sharing

General

Malware Config

Signatures

File Explorer

Load.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cold.accde

$TEMP/Cumshot.accde

$TEMP/Else.accde

$TEMP/Ot.accde

$TEMP/Pills.accde

$TEMP/Sensitive.accde

$TEMP/Spank.accde

Agreed

Area

Bobby

Coalition

Hash

Hk

Madonna

Managed

Martial

Write