loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 953KB
Sample260712-bc9nlabw7p
SHA256 5ca1256cea08c00cb85e2fa6793b8b8df631a8cef5eda45423093e8d522b2d98
MD5 3cd89d2c98877e87a1a146d0c193389a
SHA1 31eb3d3f454c1695968bbfe0ab44292bbce4e751
SHA512 6d6a6abaa95fbb9329c488c8d923d607ca8e24b391f601f41b58eddbffdfa26c19e4ad12b7700801f03f0947ad69aee0c2d221845125f9f973621ab0136eb270
SSDEEP 24576:rAAkDllSX4xQOjVjBhvcCKtzCj9HtW39WEUKi1n:E1BoauUT1n
TLSH
T1CF25B04AB2E901FDD07BE1389956AA0BEA75344903604EDF17E046662FA37F09F7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 953KB

loader.exe

IMPHASH b9e1229032414ff15836599d7946ce75
SHA256 5ca1256cea08c00cb85e2fa6793b8b8df631a8cef5eda45423093e8d522b2d98
MD5 3cd89d2c98877e87a1a146d0c193389a
SHA1 31eb3d3f454c1695968bbfe0ab44292bbce4e751
SHA512 6d6a6abaa95fbb9329c488c8d923d607ca8e24b391f601f41b58eddbffdfa26c19e4ad12b7700801f03f0947ad69aee0c2d221845125f9f973621ab0136eb270
SSDEEP 24576:rAAkDllSX4xQOjVjBhvcCKtzCj9HtW39WEUKi1n:E1BoauUT1n
TLSH
T1CF25B04AB2E901FDD07BE1389956AA0BEA75344903604EDF17E046662FA37F09F7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

567228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertGetCertificateChain CertOpenSystemStoreA CertFreeCertificateContext CertGetNameStringA CertGetCertificateContextProperty CertFreeCertificateChain CertCloseStore CertEnumCertificatesInStore CryptStringToBinaryA

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptVerifySignature BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider

advapi32

OpenServiceA StartServiceA ControlService RegCloseKey CloseServiceHandle RegQueryValueExA OpenSCManagerA RegCreateKeyExA RegSetValueExA

shell32

ShellExecuteW ShellExecuteExA

user32

SetLayeredWindowAttributes GetCursorPos GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW UpdateWindow TranslateMessage PostQuitMessage

kernel32

CreateProcessW GetExitCodeProcess HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WriteConsoleW SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx DecodePointer ReadFile GetModuleFileNameA GetACP WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess CreateNamedPipeW GetProcessId Thread32Next ExpandEnvironmentStringsA SetFilePointer Thread32First WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread QueryPerformanceFrequency DeleteFileA Process32FirstW GlobalFree CloseHandle SetFileAttributesA Module32FirstW GetThreadContext GetProcAddress VirtualAllocEx CreateFileMappingA LocalFree ExitProcess GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte CreateRemoteThread Module32NextW CreateProcessA CreateDirectoryA VirtualFreeEx MapViewOfFile QueryPerformanceCounter GetTickCount OpenThread IsDebuggerPresent ConnectNamedPipe SetEndOfFile FlushFileBuffers OutputDebugStringA GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte FreeLibrary EncodePointer IsValidCodePage FindNextFileW FindFirstFileExW FindClose DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ReadConsoleW GetFileSizeEx GetFileAttributesExW ResetEvent CheckRemoteDebuggerPresent InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx Sleep GetExitCodeThread LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime

ole32

CoCreateInstance CoInitializeEx CoUninitialize

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

743KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

d3d11

dwmapi

winhttp

crypt32

bcrypt

advapi32

shell32

user32

kernel32

ole32

imm32

d3dcompiler_47

generic