Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 1.2MB
Sample260705-thy36adw8x
SHA256 5204cb610b14597b12a2b9179f7dda7d22419fe0afee7731325756e76a8fe941
MD5 37991d462084dbaef96f23f952c812b0
SHA1 e0f703700b1ddbd4145b87a5b6d7fd975f0756fc
SHA512 e2104d5d715495ddfc27baa73f65ee4a0d5a078c430550c605fe1dfa77122ffe4a691f043e20061c7b234e93f6fac75d0edcec307876e6fb5b07a315c07ea3be
SSDEEP 24576:X8t4QqnHVkcZsq7MO2SnAesen83QVJ5E:TZKcXUepnt
TLSH
T1B3457D57B7E601CCD676A634CA76B617B87478040A3A87DB2B4049539FF3B90E9BB301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 1.2MB

Loader.exe

IMPHASH 4024fd389cdbe3d51d16b52fa6e94d58
SHA256 5204cb610b14597b12a2b9179f7dda7d22419fe0afee7731325756e76a8fe941
MD5 37991d462084dbaef96f23f952c812b0
SHA1 e0f703700b1ddbd4145b87a5b6d7fd975f0756fc
SHA512 e2104d5d715495ddfc27baa73f65ee4a0d5a078c430550c605fe1dfa77122ffe4a691f043e20061c7b234e93f6fac75d0edcec307876e6fb5b07a315c07ea3be
SSDEEP 24576:X8t4QqnHVkcZsq7MO2SnAesen83QVJ5E:TZKcXUepnt
TLSH
T1B3457D57B7E601CCD676A634CA76B617B87478040A3A87DB2B4049539FF3B90E9BB301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

664480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\d7988\Downloads\externalfn\艾薇 lockerlab private\externalfn_\build\Loader.pdb

kernel32

CreateFileW OpenProcess GetCommandLineA CreateToolhelp32Snapshot Sleep GetLastError Process32Next CloseHandle WritePrivateProfileStringA GetStartupInfoA ExitProcess GetModuleHandleW GetConsoleWindow lstrcmpiA GetPrivateProfileIntA GetPrivateProfileStringA SetUnhandledExceptionFilter MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentProcessId WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualAlloc DeviceIoControl GetCurrentProcess Process32First QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock GlobalAlloc GlobalFree GlobalLock InitializeSListHead WideCharToMultiByte

user32

CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconA DispatchMessageA SetWindowPos GetSystemMetrics GetAsyncKeyState PeekMessageA PostQuitMessage GetDesktopWindow RegisterClassExA GetKeyState LoadCursorA ScreenToClient GetWindowLongA ClientToScreen GetForegroundWindow SetCursor GetClientRect SetCursorPos SetWindowLongA GetCursorPos SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetWindowsHookExA DefWindowProcA

advapi32

PrivilegeCheck OpenProcessToken LookupPrivilegeValueA GetTokenInformation SetTokenInformation CreateProcessAsUserA DuplicateTokenEx SetThreadToken RevertToSelf

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy _CxxThrowException __C_specific_handler __std_terminate strstr __current_exception_context __current_exception memset memmove memcpy memcmp memchr wcsstr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s ftell __acrt_iob_func __p__commode fflush fclose fseek __stdio_common_vfprintf _set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

__p___argc _wassert exit _beginthreadex _exit _register_thread_local_exe_atexit_callback system _initterm _get_initial_narrow_environment _c_exit _set_app_type _seh_filter_exe _initterm_e _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate __p___argv

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-math-l1-1-0

sin sinf sqrtf atan2f tanf powf ceilf __setusermatherr logf cosf pow log fmodf acosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

Name

.text

Size

657KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

410KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

kernel32

user32

advapi32

msvcp140

imm32

d3dcompiler_47

dwmapi

d3d11

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic