Loader[.]exe | Triage™

Resubmissions

04/06/2026, 17:31

260604-v3nnlabv216

04/06/2026, 17:30

260604-v271vabv2w6

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 3.3MB
Sample260604-v3nnlabv21
SHA256 8c99af5e032ba20d7c1cf20079ba1b01b8d50a7bac2e642319aed69946267f22
MD5 be2c3e8dd86998342d5a303982249a6d
SHA1 1651f55618ef398ca8012e6b2d6ede843070b6b3
SHA512 3378c48010487b2539d5da9cf361f767b3bd5e5067ec7c452af602f697a97245ed5360fe2d64763912c994cc771f73a70372a509df31c96bb0eb4d52378ffae9
SSDEEP 49152:WRTQrCCxyfW1Kj1l2Oa4l4YZKzCcQSOO4yrmGY/anXl/5denApFmrhLGLqn3neom:tOCA7/anXl/5denApFmlLGLfp
TLSH
T1B7F5BF45B2A540E8DF77D138C9469A13E6713CC8033197EB27E48AA61F336F15A7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 3.3MB

Loader.exe

IMPHASH 817ef54ebb8b1e37c66dc66a4123b48a
SHA256 8c99af5e032ba20d7c1cf20079ba1b01b8d50a7bac2e642319aed69946267f22
MD5 be2c3e8dd86998342d5a303982249a6d
SHA1 1651f55618ef398ca8012e6b2d6ede843070b6b3
SHA512 3378c48010487b2539d5da9cf361f767b3bd5e5067ec7c452af602f697a97245ed5360fe2d64763912c994cc771f73a70372a509df31c96bb0eb4d52378ffae9
SSDEEP 49152:WRTQrCCxyfW1Kj1l2Oa4l4YZKzCcQSOO4yrmGY/anXl/5denApFmrhLGLqn3neom:tOCA7/anXl/5denApFmlLGLfp
TLSH
T1B7F5BF45B2A540E8DF77D138C9469A13E6713CC8033197EB27E48AA61F336F15A7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1852336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

VerSetConditionMask

winhttp

WinHttpQueryHeaders WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpOpen

kernel32

SetConsoleMode GetConsoleMode SetFileAttributesA ExitProcess GetModuleHandleW ReadProcessMemory SetCurrentConsoleFontEx GetTempPathA DeleteFileA GetCurrentConsoleFontEx SetConsoleCP SetConsoleOutputCP GetTempFileNameA Module32Next GetProcessId Module32First GetConsoleWindow CreateFileW GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameA GetModuleFileNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte GetSystemDirectoryW CheckRemoteDebuggerPresent SleepEx GetSystemInfo MoveFileExW K32GetModuleInformation GetFileType WaitForMultipleObjects VerifyVersionInfoW GlobalLock FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW VirtualProtect VirtualQuery GetTickCount OpenProcess IsDebuggerPresent K32EnumProcessModules GetProcessHeap GetThreadContext RaiseException K32GetModuleBaseNameA Process32Next GetCurrentThread CreateToolhelp32Snapshot DuplicateHandle ResumeThread SuspendThread GetEnvironmentVariableA SetThreadPriority GetCurrentProcess HeapFree Process32First GetStdHandle GetFileSizeEx QueryPerformanceCounter QueryPerformanceFrequency TerminateProcess OutputDebugStringA WaitForSingleObjectEx SetThreadAffinityMask GlobalFree GlobalAlloc GetLocaleInfoA GetModuleHandleA LoadLibraryW GlobalUnlock MultiByteToWideChar Sleep PeekNamedPipe GetCurrentProcessId CloseHandle CreateFileA WriteFile ReadFile FreeLibrary GetProcAddress LoadLibraryA GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI LocalFree

user32

ReleaseDC DispatchMessageA IsWindow SetWindowLongA IsChild DefWindowProcA CreateWindowExA PeekMessageA LoadCursorA GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen SetCursorPos GetDC GetCursorPos IsWindowUnicode UnregisterClassA RegisterClassExA TrackMouseEvent OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW ValidateRect SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow IsWindowVisible FindWindowExA GetClientRect GetKeyState SetCursor EnumWindows GetClassNameA SetCapture GetForegroundWindow GetKeyboardLayout SendInput FindWindowA GetAsyncKeyState ShowCursor GetDesktopWindow GetWindowRect GetWindowTextLengthA GetWindowTextA MonitorFromPoint MessageBoxA ReleaseCapture

gdi32

GetDeviceCaps

advapi32

SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA CopySid RegDeleteKeyA RegCreateKeyExA IsValidSid GetTokenInformation GetLengthSid OpenProcessToken QueryServiceStatus CloseServiceHandle OpenSCManagerA OpenServiceA CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteA ShellExecuteW

ole32

CoCreateInstance CoInitializeEx

msvcp140

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@D@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_id _Thrd_join ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z _Xtime_get_ticks ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Cnd_broadcast ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea

winmm

timeGetTime

urlmon

URLDownloadToFileA

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

crypt32

PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertGetNameStringW CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CryptQueryObject

ws2_32

htonl getpeername getsockname select __WSAFDIsSet WSAIoctl listen freeaddrinfo recv htons recvfrom sendto WSAResetEvent socket ioctlsocket gethostname WSAEventSelect WSAEnumNetworkEvents connect getaddrinfo bind WSACleanup WSAWaitForMultipleEvents closesocket WSACreateEvent WSAGetLastError inet_pton WSACloseEvent ntohs WSASetLastError send getsockopt inet_ntop setsockopt WSAStartup accept

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception wcschr strrchr memset memmove memcmp memchr __current_exception_context __C_specific_handler _purecall strchr strstr __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memcpy

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode realloc free

api-ms-win-crt-math-l1-1-0

ceilf cosf atan2f roundf fmodf _dclass sinf _fdopen ldexp _dsign powf __setusermatherr asinf _fdclass nearbyint floorf logf sqrtf acosf

api-ms-win-crt-stdio-l1-1-0

fseek fclose _lseeki64 fflush __p__commode fwrite _read _write _wfopen fread _fileno _close __stdio_common_vsscanf ftell __stdio_common_vsprintf _popen _pclose __stdio_common_vsprintf_s _wopen _set_fmode __stdio_common_vfprintf feof fopen_s fgets fputc __acrt_iob_func fgetc _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fputs

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _gmtime64 _time64

api-ms-win-crt-string-l1-1-0

tolower wcscpy_s _stricmp strcmp strlen wcslen _strdup _wcsdup wcsncpy strpbrk wcsncmp strcspn strcpy_s strncmp strspn wcspbrk toupper strncpy

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-convert-l1-1-0

strtoll strtod strtoull strtoul strtol atoi strtof wcstombs atof

api-ms-win-crt-runtime-l1-1-0

terminate _invoke_watson system _beginthreadex _resetstkoflw exit _register_thread_local_exe_atexit_callback __sys_errlist __sys_nerr _errno _invalid_parameter_noinfo abort _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _c_exit _get_initial_narrow_environment _initterm _initterm_e _exit __p___argv __p___argc

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _lock_file _unlock_file _unlink _fstat64

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv