loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 2.7MB
Sample260703-twdpdahw8p
SHA256 997f21d555c87bdcd782d0c01d0879b0a2d022b77598ce95d8a492e9e010ef84
MD5 95d93c609c21bca0613afdc66f36f20d
SHA1 2f9afd2f54b9fe0d42e8a3ec508cddbfe2e11d6e
SHA512 082622816009c9df2e203149a9d23d0c55581a5389fc3c8ba7894c8e26ed57db95c44c46f673ee07ffa59e5fa859c511249209fa005f5838ce0d0941c35bf63c
SSDEEP 12288:7amyudN6K/TSdk4ehneqfFn/l9e3AbwAHIAu4cZZCpziXhfldnGRYtKOr7FzJpKg:vyeH/T4ehneqfFWecZZCp+zG2tzFlg2
TLSH
T154D5C757E7B661E0D0BAC138D553622EFC7134A6833897EB66C58E461B60BE4EE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 2.7MB

loader.exe

IMPHASH 22fb0f0fe9914dd785b578b989085c15
SHA256 997f21d555c87bdcd782d0c01d0879b0a2d022b77598ce95d8a492e9e010ef84
MD5 95d93c609c21bca0613afdc66f36f20d
SHA1 2f9afd2f54b9fe0d42e8a3ec508cddbfe2e11d6e
SHA512 082622816009c9df2e203149a9d23d0c55581a5389fc3c8ba7894c8e26ed57db95c44c46f673ee07ffa59e5fa859c511249209fa005f5838ce0d0941c35bf63c
SSDEEP 12288:7amyudN6K/TSdk4ehneqfFn/l9e3AbwAHIAu4cZZCpziXhfldnGRYtKOr7FzJpKg:vyeH/T4ehneqfFWecZZCp+zG2tzFlg2
TLSH
T154D5C757E7B661E0D0BAC138D553622EFC7134A6833897EB66C58E461B60BE4EE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1110990

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\OneDrive\Desktop\skeet\x64\Debug\loader.pdb

kernel32

GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess ExitProcess CreateThread CreateRemoteThread GetExitCodeThread GetProcessId OpenProcess GetTickCount GetSystemDirectoryW VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress WriteFile SetConsoleMode WriteConsoleA SetConsoleCP SetConsoleOutputCP SetConsoleTitleW SetCurrentConsoleFontEx GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetOEMCP DeleteFileW CreateFileW GetConsoleMode GetStdHandle GetACP IsValidCodePage PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RaiseException GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree HeapSize HeapValidate GetSystemInfo TerminateProcess GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetCurrentThread GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID RtlUnwind

user32

GetWindowTextW GetWindowLongW SetWindowLongW EnumWindows GetWindowThreadProcessId IsWindowVisible GetWindow SetLayeredWindowAttributes

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

shell32

ShellExecuteW

winhttp

WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest WinHttpReceiveResponse

Name

.textbss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

589B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

user32

advapi32

shell32

winhttp

generic