CheraxLoader[.]exe

Resubmissions

22/05/2026, 22:43

260522-2nbttah18t8

22/05/2026, 22:42

260522-2ml86ah17s3

Sharing

Copy URL Twitter E-mail

General

Target
CheraxLoader.exe
Size 6.5MB
Sample260522-2nbttah18t
SHA256 c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60
MD5 ac1a7c7d5846970fa3ba1eccad346737
SHA1 1154fcf391eebb268ca0558afa6508627ed80055
SHA512 c37293a7184bc97cca10492cb9fbef9d2ea907cb18b6091da2434c5489e289a7b4d001a2aba4a18ba82721b44c15dd1c5dcbf4d69dda966ceba7ef01703ba2b9
SSDEEP 196608:BdS5kN51OPnAxHVNYgK0SSsF5mVgp00rrxLighFe/I81ykvm:BdLNePnAxHVNYgK0SSsF5mVgp00rrxLs
TLSH
T10D66DF5676ED81B9C666F2388647C527E7B17E090321C6EB32D09B673F23AE41A3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheraxLoader.exe

File Explorer

CheraxLoader.exe

.exe 6.5MB

CheraxLoader.exe

IMPHASH 2f9a426d9ddf68b9aefafbe8d6ecfc15
SHA256 c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60
MD5 ac1a7c7d5846970fa3ba1eccad346737
SHA1 1154fcf391eebb268ca0558afa6508627ed80055
SHA512 c37293a7184bc97cca10492cb9fbef9d2ea907cb18b6091da2434c5489e289a7b4d001a2aba4a18ba82721b44c15dd1c5dcbf4d69dda966ceba7ef01703ba2b9
SSDEEP 196608:BdS5kN51OPnAxHVNYgK0SSsF5mVgp00rrxLighFe/I81ykvm:BdLNePnAxHVNYgK0SSsF5mVgp00rrxLs
TLSH
T10D66DF5676ED81B9C666F2388647C527E7B17E090321C6EB32D09B673F23AE41A3D350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3792832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW Process32NextW ReleaseMutex CreateMutexA ExitProcess GetFileAttributesA GetModuleFileNameA CreateProcessA GetThreadContext LoadLibraryA GetCurrentThread CreateFileA VirtualProtect GetCurrentProcessId ReadProcessMemory VirtualAllocEx GetProcAddress GetLastError OpenProcess GetModuleHandleA VirtualAlloc GetCurrentProcess VirtualFree CreateFileMappingA UnmapViewOfFile MapViewOfFile WriteConsoleW HeapSize SetEndOfFile CloseHandle GetModuleHandleW UnhandledExceptionFilter GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW CreateProcessW GetExitCodeProcess SetStdHandle DeleteFileW FlushFileBuffers AddVectoredExceptionHandler GetCurrentThreadId RemoveVectoredExceptionHandler GetComputerNameA GetVolumeInformationA GetConsoleMode GetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceFrequency TryAcquireSRWLockExclusive WaitForSingleObjectEx Sleep GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetLocaleInfoA FreeLibrary GlobalAlloc GlobalFree GlobalLock GlobalUnlock SetLastError FormatMessageW GetSystemDirectoryW LoadLibraryW WaitForSingleObject CreateEventW SetEvent GetTickCount SleepEx VerifyVersionInfoW GetEnvironmentVariableA ReadFile GetStdHandle WaitForMultipleObjects PeekNamedPipe GetFileType GetFileSizeEx RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW WriteFile SetFilePointerEx HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation RtlUnwind

user32

OpenClipboard CloseClipboard ShowWindow GetActiveWindow MessageBoxA EmptyClipboard FlashWindowEx SetForegroundWindow IsIconic DefWindowProcW GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout

gdi32

BitBlt

advapi32

OpenProcessToken RegOpenKeyExA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegGetValueA RegQueryValueExA GetUserNameA CryptDestroyKey CryptEncrypt OpenThreadToken CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptImportKey

shell32

ShellExecuteA SHGetKnownFolderPath ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoTaskMemFree GetHGlobalFromStream CreateStreamOnHGlobal CLSIDFromString CoInitializeEx

dbghelp

SymFunctionTableAccess64 SymGetModuleBase64

version

GetFileVersionInfoA VerQueryValueA VerQueryValueW GetFileVersionInfoSizeA

ntdll

VerSetConditionMask RtlVirtualUnwind RtlLookupFunctionEntry RtlInitUnicodeString NtQuerySystemInformation RtlCaptureContext

d3dcompiler_47

D3DCompile

gdiplus

GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdiplusShutdown GdipSaveImageToStream GdipFree GdipCloneImage GdiplusStartup

winmm

PlaySoundW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

bcrypt

BCryptGenRandom

ws2_32

WSAGetLastError WSAEnumNetworkEvents getsockopt WSAWaitForMultipleEvents WSAStartup WSAResetEvent WSAEventSelect WSACreateEvent WSACloseEvent ntohs WSASetLastError closesocket setsockopt htons recv connect socket getsockname getpeername WSAIoctl bind select __WSAFDIsSet sendto recvfrom listen accept htonl freeaddrinfo getaddrinfo ioctlsocket gethostname WSACleanup send

wldap32

ord142 ord147 ord41 ord14 ord208 ord216 ord79 ord27 ord145 ord26 ord127 ord46 ord117 ord301 ord219 ord133 ord73 ord167

crypt32

CertFreeCertificateChainEngine PFXImportCertStore CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CertOpenStore CryptStringToBinaryW CryptDecodeObjectEx CertFindExtension CertGetCertificateChain CertAddCertificateContextToStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChain CertGetNameStringW

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cpax

Size

702KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

CheraxLoader.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

dbghelp

version

ntdll

d3dcompiler_47

gdiplus

winmm

imm32

bcrypt

ws2_32

wldap32

crypt32

generic