GCSLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GCSLoader.exe
Size 26.0MB
Sample260709-wpvqesft2n
SHA256 b0eb410a52e761876f76880bb5402cc1e01aef2ff27bb014009ecf18307cda40
MD5 133acdd46807a795ab2ff49fe461ec9d
SHA1 3019e9da79c084c592bf1f75b8e3ff453fe665d5
SHA512 3a93021350de79713830c43bf3408ac3de256124e597aad3a8b83b33f7c7373da773c4d1cc8c66fd76a41d7b0283753556fa6c54ae51f31a375b2ced0a8f7d4f
SSDEEP 393216:7a/CKw1VQojtaJ6hVcFRCsfpF2d6gbnaegkpbCEHtkSNBhuHmNCB:Gw1GojYJgeFR/wdCob6moHmNCB
TLSH
T1FA5712CAA8E591DCCB418474E28559EAE1C9B8CE4DBA053BBFCB4C027134E55C8F9E71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GCSLoader.exe

File Explorer

GCSLoader.exe

.exe 26.0MB

GCSLoader.exe

IMPHASH 10dce8d24309cb129b0fd0dc7eaa9150
SHA256 b0eb410a52e761876f76880bb5402cc1e01aef2ff27bb014009ecf18307cda40
MD5 133acdd46807a795ab2ff49fe461ec9d
SHA1 3019e9da79c084c592bf1f75b8e3ff453fe665d5
SHA512 3a93021350de79713830c43bf3408ac3de256124e597aad3a8b83b33f7c7373da773c4d1cc8c66fd76a41d7b0283753556fa6c54ae51f31a375b2ced0a8f7d4f
SSDEEP 393216:7a/CKw1VQojtaJ6hVcFRCsfpF2d6gbnaegkpbCEHtkSNBhuHmNCB:Gw1GojYJgeFR/wdCob6moHmNCB
TLSH
T1FA5712CAA8E591DCCB418474E28559EAE1C9B8CE4DBA053BBFCB4C027134E55C8F9E71
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22512099

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GlobalGetAtomNameA

user32

GetWindowThreadProcessId

gdi32

CreateSolidBrush

advapi32

AllocateAndInitializeSid

shell32

ShellExecuteExA

ole32

CoCreateInstance

msvcp140

?id@?$ctype@D@std@@2V0locale@2@A

bcrypt

BCryptGenRandom

winmm

PlaySoundA

imm32

ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute

dcomp

DCompositionCreateDevice

wininet

InternetOpenUrlA

shlwapi

ord12

ws2_32

bind

psapi

GetModuleInformation

ntdll

RtlLookupFunctionEntry

crypt32

CertEnumCertificatesInStore

avrt

AvSetMmThreadPriority

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-string-l1-1-0

strncpy_s

api-ms-win-crt-convert-l1-1-0

strtof

api-ms-win-crt-stdio-l1-1-0

fgets

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

17.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

25.9MB

Virtual Size

25.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GCSLoader.exe

urlmon

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

bcrypt

winmm

imm32

dwmapi

dcomp

wininet

shlwapi

ws2_32

psapi

ntdll

crypt32

avrt

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic