loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 4.4MB
Sample260619-vbamnahy2n
SHA256 6b57cab2d574573ea120aee4068af5fc214967e92705687def3abe63941abee2
MD5 1656ce7d9e6cdd23762ae30c72b015f2
SHA1 2a80ce310c493a33444ab108550bbff18e1ce49e
SHA512 be1942a21d0f753a66412b26ea2278ea9ca56166fde60431c6db857d9f72271608d377a3bf5bcda408a614c1f09d29a3172ed6bf5e691169217456066befa55b
SSDEEP 49152:ej7GJeIciWIEobriVazGFSimxn2G015YjzlYFyeIKaQY3WUikVjmwEx1zERPRe0:eO0IguBzbitG01cXQYGzkxu2
TLSH
T191266B07B65651ACC476C430D357E776BF34BC852E24999BC284FA383EBE6A41E2B704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 4.4MB

loader.exe

IMPHASH 70b4f6690627efdbdfd51ed2d499854c
SHA256 6b57cab2d574573ea120aee4068af5fc214967e92705687def3abe63941abee2
MD5 1656ce7d9e6cdd23762ae30c72b015f2
SHA1 2a80ce310c493a33444ab108550bbff18e1ce49e
SHA512 be1942a21d0f753a66412b26ea2278ea9ca56166fde60431c6db857d9f72271608d377a3bf5bcda408a614c1f09d29a3172ed6bf5e691169217456066befa55b
SSDEEP 49152:ej7GJeIciWIEobriVazGFSimxn2G015YjzlYFyeIKaQY3WUikVjmwEx1zERPRe0:eO0IguBzbitG01cXQYGzkxu2
TLSH
T191266B07B65651ACC476C430D357E776BF34BC852E24999BC284FA383EBE6A41E2B704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2078632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateEventA CreateFileA CreateFileW CreateThread DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeThread GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OutputDebugStringA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DefWindowProcW DestroyWindow DispatchMessageA EmptyClipboard ExitWindowsEx GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics IsWindowUnicode LoadCursorA LoadIconA MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware ShowWindow TrackMouseEvent TranslateMessage UpdateWindow

shell32

ShellExecuteA ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

d3dcompiler_47

D3DCompile

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA CertOpenStore CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA PFXImportCertStore

wldap32

ord301 ord45 ord22 ord32 ord26 ord30 ord35 ord143 ord200 ord41 ord33 ord27 ord50 ord211 ord60 ord217 ord46 ord79

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

321B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

advapi32

bcrypt

kernel32

user32

shell32

d3d11

d3dx11_43

dwmapi

gdi32

ws2_32

d3dcompiler_47

imm32

crypt32

wldap32

generic