FINAL_LOADER[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FINAL_LOADER.exe
Size 313KB
Sample260601-sdlrlagv71
SHA256 3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166
MD5 3e1a5b82f82ce40b067956f309403ae6
SHA1 6695c54387c7a1543fbbb3c79436d56b9294f796
SHA512 959978584fc66b2c7aafc991b5765bc6b9821abb59c73c07e7d879f360c471b08d554f2c92caee7eca08677d152ab898f957be1807ab85a37876c420a194e4f2
SSDEEP 6144:BSEXjj9k7cI2pCwm7qKydh6zZ9HSE9garThZsFlk2+DU:B/jm1wm7qKyP6zZb5TDv2+
TLSH
T145647C47BAA565BCD156C034A35796B3BA33B8CE03307DBF12E486302E69D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FINAL_LOADER.exe

File Explorer

FINAL_LOADER.exe

.exe 313KB

FINAL_LOADER.exe

IMPHASH 6e18ed5d8776163c83db19cdf9a8d3a7
SHA256 3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166
MD5 3e1a5b82f82ce40b067956f309403ae6
SHA1 6695c54387c7a1543fbbb3c79436d56b9294f796
SHA512 959978584fc66b2c7aafc991b5765bc6b9821abb59c73c07e7d879f360c471b08d554f2c92caee7eca08677d152ab898f957be1807ab85a37876c420a194e4f2
SSDEEP 6144:BSEXjj9k7cI2pCwm7qKydh6zZ9HSE9garThZsFlk2+DU:B/jm1wm7qKyP6zZb5TDv2+
TLSH
T145647C47BAA565BCD156C034A35796B3BA33B8CE03307DBF12E486302E69D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CreateEventW CreateFileMappingA CreateFileW CreateProcessA CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MoveFileA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx WriteProcessMemory __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fflush fprintf free malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FINAL_LOADER.exe

api-ms-win-core-synch-l1-2-0

kernel32

msvcrt

ntdll

generic