loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 106KB
Sample260706-zzhemagy2q
SHA256 026fcc119a1bb6114d05c70d30107fb266e2c4ac98b1d6154f69bf27cee30cfc
MD5 d80d0396d178d8c8aa428cfbedf7bd5c
SHA1 7ee7c06fd8a00c813d2a41af232ace14f37c3943
SHA512 67af3e55ab3abd8c9e4ff7241a0682e46aad9196ccc7fea42b5df259de3535749892fbbe8ddf75bc554b73455aeb98dc759802657e9d5053105bef7f757be81e
SSDEEP 1536:+u2Gg/5xT1PMsvbr5NfiPHQRMspLve8VqNEM1IcAemMnGMVIqT:RNgjBtvbr5NfiPHgM6XsxIq
TLSH
T17DB32A37EA1900AED266D9B4DA665D02D771BCCA03716BCF53806CE60F2A1D85F3FA11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 106KB

loader.exe

IMPHASH ea4017821f72f64939fb3540ed1a4acf
SHA256 026fcc119a1bb6114d05c70d30107fb266e2c4ac98b1d6154f69bf27cee30cfc
MD5 d80d0396d178d8c8aa428cfbedf7bd5c
SHA1 7ee7c06fd8a00c813d2a41af232ace14f37c3943
SHA512 67af3e55ab3abd8c9e4ff7241a0682e46aad9196ccc7fea42b5df259de3535749892fbbe8ddf75bc554b73455aeb98dc759802657e9d5053105bef7f757be81e
SSDEEP 1536:+u2Gg/5xT1PMsvbr5NfiPHQRMspLve8VqNEM1IcAemMnGMVIqT:RNgjBtvbr5NfiPHgM6XsxIq
TLSH
T17DB32A37EA1900AED266D9B4DA665D02D771BCCA03716BCF53806CE60F2A1D85F3FA11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\KADIRRR\Desktop\New folder (6)\x64\Release\loader.pdb

urlmon

URLDownloadToFileW

shell32

ShellExecuteExW

kernel32

GetStdHandle SetConsoleMode GetConsoleCursorInfo GetModuleFileNameW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetConsoleMode SetConsoleCursorInfo Process32NextW Process32FirstW CloseHandle FillConsoleOutputAttribute GetProcAddress VirtualAllocEx SetConsoleCP GetModuleHandleW CreateRemoteThread SetConsoleOutputCP VirtualFreeEx SetConsoleCursorPosition GetComputerNameA SetConsoleTitleA GetConsoleScreenBufferInfo WriteProcessMemory FillConsoleOutputCharacterA GetFileInformationByHandleEx MoveFileExW GetLastError CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentProcess MultiByteToWideChar GetSystemTimeAsFileTime InitializeSListHead Sleep GetCurrentThreadId SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId WideCharToMultiByte

advapi32

GetTokenInformation GetUserNameA LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ _Thrd_join _Xtime_get_ticks _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

winhttp

WinHttpReadData WinHttpSendRequest WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpOpenRequest

bcrypt

BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptEncrypt BCryptDestroyKey

crypt32

CryptStringToBinaryA CryptBinaryToStringA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset __current_exception_context _CxxThrowException memmove memcpy memcmp __std_terminate __std_exception_copy __std_exception_destroy __current_exception

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen toupper isalnum strlen tolower

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _initterm _exit __p___argc _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _register_thread_local_exe_atexit_callback _c_exit abort __p___argv _get_initial_narrow_environment exit terminate

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-stdio-l1-1-0

_kbhit __stdio_common_vsprintf __p__commode _set_fmode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

atol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr fmodf