Loader[.]exe | Triage™

General

Target
Loader.exe
Size 223KB
Sample260529-aeytfaev9x
SHA256 eb52f382e173508f0bb7457989747f741ca58a3281952cc8baac9ba41ff8781f
MD5 1bd35ea7751631ed25dc8fdbca656f37
SHA1 7d263ae178eccfcefa5b784477c2c807c232dec7
SHA512 f9d0eed2df785a4fba5a622cfd76b4199025b066673204a132e41a4f63a1e586a1056fdc2ca453c3304ff4abe0b92cfe3dc6b07f146649e1c812413f4b4176b1
SSDEEP 3072:QrQE1sKaHDaW5IKOnRlAWsHWdvWw+IB17tfmqfsd25QaOv78Ff4dJeDc:nE1sK0FIvRb15+IEIssRk72c
TLSH
T1F6248E1AA5610CF4E7B3DABCDA164E12CAB378554FF4A65F1B744AF24E235908F2D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 223KB

Loader.exe

IMPHASH 64d94a0df3e4bb6cedc61a34e73a37ff
SHA256 eb52f382e173508f0bb7457989747f741ca58a3281952cc8baac9ba41ff8781f
MD5 1bd35ea7751631ed25dc8fdbca656f37
SHA1 7d263ae178eccfcefa5b784477c2c807c232dec7
SHA512 f9d0eed2df785a4fba5a622cfd76b4199025b066673204a132e41a4f63a1e586a1056fdc2ca453c3304ff4abe0b92cfe3dc6b07f146649e1c812413f4b4176b1
SSDEEP 3072:QrQE1sKaHDaW5IKOnRlAWsHWdvWw+IB17tfmqfsd25QaOv78Ff4dJeDc:nE1sK0FIvRb15+IEIssRk72c
TLSH
T1F6248E1AA5610CF4E7B3DABCDA164E12CAB378554FF4A65F1B744AF24E235908F2D700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI CloseHandle GetLastError GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockShared AcquireSRWLockShared LocalFree FormatMessageA GetLocaleInfoEx RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCPInfo IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap GetFileType SetStdHandle GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW WriteConsoleW

Name

.text

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

kernel32

generic