loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.9MB
Sample260415-pffftadw2l
SHA256 bb35467b8ae44797ed23cade53c598505eac7e34352974797e92c238a4a9d52a
MD5 d4e8d88a9fbb1f4994b9c1775354750f
SHA1 02b238a47b96800cb234839a4fc2a48196a70538
SHA512 7da3f89aa08f4f41a36dc36609265dbcfa2ba953764d3ea61d2e674760664f4ec51c75f16d733bade12d40eb921f1f4d53323da281cb56e613ce922f5160edba
SSDEEP 49152:ahNnbPN99dyIVRG9K6hU/S7CQnfGTXbFNL3DUMuFA6MVdh5kgh3kusPuOSsuUG9K:MJPNkAk9t
TLSH
T10195CFA1F3961510D056A4385FE3C33BB276F4442E12A28BB5EA46746B857F12DFE3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.9MB

loader.exe

IMPHASH 6dcc91fd173506622481dcff2dd6bf10
SHA256 bb35467b8ae44797ed23cade53c598505eac7e34352974797e92c238a4a9d52a
MD5 d4e8d88a9fbb1f4994b9c1775354750f
SHA1 02b238a47b96800cb234839a4fc2a48196a70538
SHA512 7da3f89aa08f4f41a36dc36609265dbcfa2ba953764d3ea61d2e674760664f4ec51c75f16d733bade12d40eb921f1f4d53323da281cb56e613ce922f5160edba
SSDEEP 49152:ahNnbPN99dyIVRG9K6hU/S7CQnfGTXbFNL3DUMuFA6MVdh5kgh3kusPuOSsuUG9K:MJPNkAk9t
TLSH
T10195CFA1F3961510D056A4385FE3C33BB276F4442E12A28BB5EA46746B857F12DFE3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

293432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\hydra_project\avetra loader\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetConsoleWindow GlobalAlloc MultiByteToWideChar UnhandledExceptionFilter GlobalUnlock RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetTickCount WideCharToMultiByte GlobalLock IsDebuggerPresent GlobalFree SetUnhandledExceptionFilter IsProcessorFeaturePresent

user32

DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow GetKeyState SetClipboardData GetWindowLongW ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursor IsWindowUnicode LoadCursorW ReleaseCapture SetCursorPos SetCapture GetClientRect

shell32

ShellExecuteW

msvcp140

??Bid@locale@std@@QEAA_KXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromFileW D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler _CxxThrowException memset strstr __current_exception __std_terminate __std_exception_copy __std_exception_destroy memcmp memcpy memmove memchr

api-ms-win-crt-stdio-l1-1-0

__p__commode fwrite __stdio_common_vfprintf fseek __stdio_common_vsprintf _wfopen fclose fflush __acrt_iob_func ftell fread __stdio_common_vsscanf _set_fmode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strncmp strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argv __p___argc _c_exit _register_thread_local_exe_atexit_callback terminate _initialize_onexit_table _wassert _invalid_parameter_noinfo_noreturn _set_app_type

api-ms-win-crt-time-l1-1-0

_time64 _localtime64

api-ms-win-crt-math-l1-1-0

ceilf acosf sinf sqrtf cosf __setusermatherr powf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale