loader[.]exe | Triage™

General

Target
loader.exe
Size 713KB
Sample260528-phex3ags4x
SHA256 6aeabb299f1bb2b1544fc3b002ae77ff51266addd189d437ba83d0d0eda221c3
MD5 9725bd8532434a70cf6c054427600909
SHA1 ed795e7a4f65d4f9afb01d10d10e9172534caacf
SHA512 18b2327565ab73e4b6c6f530e96d2f644b259c2553577c0a63013a4c2c8f0c5834afd3ffcdaf186576ca93668beee8fb60cbe7a53f476bab20862ff3290885a7
SSDEEP 12288:jVAghAlnDyfN5Jd/2LFZyfrO4eDAiuKp3YdySuwby:jyoqDyfN52LFZyfCZDAiuKp3YdySu
TLSH
T12CF48D2AB75401F9D1A7C178CA928616F772B84353719BCB33EC46A61F2B6E45E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 713KB

loader.exe

IMPHASH a41989821a5dc18be72b69d45c6fb196
SHA256 6aeabb299f1bb2b1544fc3b002ae77ff51266addd189d437ba83d0d0eda221c3
MD5 9725bd8532434a70cf6c054427600909
SHA1 ed795e7a4f65d4f9afb01d10d10e9172534caacf
SHA512 18b2327565ab73e4b6c6f530e96d2f644b259c2553577c0a63013a4c2c8f0c5834afd3ffcdaf186576ca93668beee8fb60cbe7a53f476bab20862ff3290885a7
SSDEEP 12288:jVAghAlnDyfN5Jd/2LFZyfrO4eDAiuKp3YdySuwby:jyoqDyfN52LFZyfCZDAiuKp3YdySu
TLSH
T12CF48D2AB75401F9D1A7C178CA928616F772B84353719BCB33EC46A61F2B6E45E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

275328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\arsen\Desktop\ClarityWebGui\x64\Release\ClarityWebGui.pdb

kernel32

GetCurrentProcess WriteFile GetModuleFileNameW WaitForSingleObject CreateFile2 UnmapViewOfFile OpenProcess MultiByteToWideChar GetExitCodeThread Sleep GetTempPathA GetLastError CreateFileA CloseHandle CreateFileMappingFromApp SetConsoleTitleA VirtualAllocEx GetModuleHandleW GetConsoleWindow CreateRemoteThread MapViewOfFileFromApp VirtualFreeEx FlushFileBuffers SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WaitNamedPipeA WriteProcessMemory GetProcAddress GetFileSizeEx GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadFile GetFileAttributesExW CreateProcessW GetExitCodeProcess SetStdHandle GetCurrentDirectoryW ReadConsoleW ReadConsoleInputW SetConsoleMode HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetNativeSystemInfo RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte GetTickCount64 LCMapStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW SetFilePointerEx HeapAlloc GetTimeZoneInformation HeapFree GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind

user32

GetWindowTextW EnumWindows ShowWindow IsWindowVisible GetWindowThreadProcessId GetClassNameW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

ws2_32

getaddrinfo WSAStartup getpeername getsockname send socket WSAAccept inet_ntoa gethostname recv WSAPoll freeaddrinfo getnameinfo setsockopt WSASocketW listen shutdown gethostbyname closesocket WSACleanup bind ntohs

Name

.text

Size

468KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

user32

advapi32

ws2_32

generic