Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 3.5MB
Sample260627-ej488sgw7z
SHA256 0899d49d3964478bd833bced56d0e0d6cd59546944694da40da3c0c577714938
MD5 4ff23dc8b0020e3a411aa427bee930cb
SHA1 eebbb400bb62f179c1841994f12bb1b003317179
SHA512 c9299eb2c73e9ed738e55d9df938e415d7c034e27a4bdcd60ab275e55ba962b13ff73c95d23f8db473ba60a2e90ca6d2d5ff50aa4b352d8529ee488201fe6f94
SSDEEP 49152:/7FulrtrrheoFnybmdQrWoK4M++94IDiWSN1W+GpdHf7krkbwWpo/U7wjgTm0Pxv:zY4fCvo/U7mgTm05AwJHE6h
TLSH
T175F5CF0DF6E646B9E2B2D17CC5A2A317F672740A53204BE73BCC05885F66BD4A63DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 3.5MB

Loader.exe

IMPHASH 3679713669d0d35f6130abc67b0bd955
SHA256 0899d49d3964478bd833bced56d0e0d6cd59546944694da40da3c0c577714938
MD5 4ff23dc8b0020e3a411aa427bee930cb
SHA1 eebbb400bb62f179c1841994f12bb1b003317179
SHA512 c9299eb2c73e9ed738e55d9df938e415d7c034e27a4bdcd60ab275e55ba962b13ff73c95d23f8db473ba60a2e90ca6d2d5ff50aa4b352d8529ee488201fe6f94
SSDEEP 49152:/7FulrtrrheoFnybmdQrWoK4M++94IDiWSN1W+GpdHf7krkbwWpo/U7wjgTm0Pxv:zY4fCvo/U7mgTm05AwJHE6h
TLSH
T175F5CF0DF6E646B9E2B2D17CC5A2A317F672740A53204BE73BCC05885F66BD4A63DB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

228432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SetWindowLongW GetWindowLongW GetWindow GetWindowThreadProcessId GetMessageW GetWindowTextLengthW GetWindowTextW IsWindowVisible SetProcessDpiAwarenessContext LoadCursorW MessageBoxW GetClientRect UpdateWindow GetSystemMetrics ReleaseCapture ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage EnumWindows

advapi32

ControlService CryptReleaseContext CryptAcquireContextW GetUserNameA RegGetValueW RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegDeleteValueA QueryServiceStatus OpenServiceA OpenSCManagerA FreeSid CloseServiceHandle RegSetValueExA RegDeleteKeyA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash AllocateAndInitializeSid CheckTokenMembership CryptGetHashParam

ole32

CoInitializeEx CoInitializeSecurity OleUninitialize OleInitialize CoSetProxyBlanket CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance

shell32

SHGetFolderPathA ShellExecuteExA SHEmptyRecycleBinA ShellExecuteExW

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpCrackUrl WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest

crypt32

CryptUnprotectData CryptProtectData

msvcp140

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?setf@ios_base@std@@QEAAHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setf@ios_base@std@@QEAAHHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

dwmapi

DwmSetWindowAttribute

oleaut32

VariantClear SysAllocString SysFreeString

urlmon

URLDownloadToFileW

shlwapi

PathFileExistsA

kernel32

CreateFileMappingA GetModuleHandleA GetProcAddress SetConsoleTextAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFullPathNameA WaitForSingleObject CreateRemoteThread GetExitCodeThread VirtualAllocEx WriteProcessMemory VirtualFreeEx GetTempPathA GetLastError GetExitCodeProcess CreateProcessA MoveFileA AllocConsole FreeConsole WriteConsoleA SetConsoleWindowInfo InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetTickCount CreateThread TerminateProcess ExitProcess GetCurrentProcess GetEnvironmentVariableW FreeLibrary LoadLibraryW LoadLibraryExW GetModuleHandleW HeapFree GetProcessHeap OutputDebugStringW OutputDebugStringA CreateFileW GetFileAttributesW SetConsoleTitleA GetConsoleWindow FindClose LocalFree GetModuleFileNameW GetModuleFileNameA IsWow64Process UnmapViewOfFile FlushViewOfFile MapViewOfFile OpenProcess Sleep CloseHandle WriteFile ReadFile GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA MultiByteToWideChar WideCharToMultiByte GetComputerNameA FindFirstFileA FindNextFileA GetVolumeInformationA GetSystemInfo GetWindowsDirectoryA GetStdHandle GetDiskFreeSpaceExA IsDebuggerPresent CheckRemoteDebuggerPresent InitializeCriticalSection EnterCriticalSection RemoveDirectoryA SetFileAttributesA LeaveCriticalSection

vcruntime140

_CxxThrowException wcsrchr __std_exception_destroy __std_exception_copy memset memmove memcpy _purecall __current_exception __current_exception_context memcmp wcsstr __C_specific_handler __std_terminate memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_errno _configure_wide_argv _set_app_type _seh_filter_exe exit _cexit _crt_atexit _initterm_e _register_onexit_function _initialize_onexit_table system terminate _get_wide_winmain_command_line _c_exit _register_thread_local_exe_atexit_callback _exit _initterm _initialize_wide_environment

api-ms-win-crt-string-l1-1-0

strlen tolower wcscmp _stricmp wcslen isdigit _wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-convert-l1-1-0

strtol strtod _wtoi wcstol _ultow_s _itoa_s

api-ms-win-crt-stdio-l1-1-0

fwrite setvbuf fopen_s __p__commode _fseeki64 fclose fsetpos fread fputc fgetpos _set_fmode fgetc fflush _get_stream_buffer_pointers fputs __stdio_common_vsprintf_s ungetc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale