Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 52KB
Sample260718-tealdsat6s
SHA256 e3c2ddc61d404f64f245775fde41a10eaabf37a4e859879508f121fc75318f2f
MD5 aed8c8be7e5099e6536a952cfa8b4059
SHA1 b0e275279878470473f3510d11d0e7ce1730091e
SHA512 772b9caaf5a7d37b012d5c37b50689f6ca107cc34ab4408bea6d6e59dee91a4a99d0bbdbad647c4fb026a102c0331bf9d4aff45ca4829351d82521c2c5f4796d
SSDEEP 768:V3i4jgD7oD7l7AqH6YTGssK0QVpFgXhPfAz7eTi0udIoRcEPAY9yysP2H5:V3i2g/u7W269PUGX9fAz7eJNqK2H5
TLSH
T12E332B2ADE1A907FD35ACD79C6530D02EE62BC8647E1E9CF97900CD60D159E4AF3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 52KB

Loader.exe

IMPHASH 2d4b79e8341a0ecfedbe367d4db50d81
SHA256 e3c2ddc61d404f64f245775fde41a10eaabf37a4e859879508f121fc75318f2f
MD5 aed8c8be7e5099e6536a952cfa8b4059
SHA1 b0e275279878470473f3510d11d0e7ce1730091e
SHA512 772b9caaf5a7d37b012d5c37b50689f6ca107cc34ab4408bea6d6e59dee91a4a99d0bbdbad647c4fb026a102c0331bf9d4aff45ca4829351d82521c2c5f4796d
SSDEEP 768:V3i4jgD7oD7l7AqH6YTGssK0QVpFgXhPfAz7eTi0udIoRcEPAY9yysP2H5:V3i2g/u7W269PUGX9fAz7eJNqK2H5
TLSH
T12E332B2ADE1A907FD35ACD79C6530D02EE62BC8647E1E9CF97900CD60D159E4AF3E602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

26912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Loader free\x64\Release\Loader.pdb

kernel32

SetConsoleScreenBufferSize GetStdHandle SetConsoleWindowInfo WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA GetLastError GetFileAttributesA Process32NextW CreateFileA GetSystemDirectoryA TerminateThread SetConsoleTitleA Process32FirstW CloseHandle GetProcAddress VirtualAllocEx CreateFileMappingA GetFileSize GetConsoleWindow CreateRemoteThread VirtualFreeEx MapViewOfFile GetTickCount IsWow64Process GetCurrentProcessId GetModuleHandleW SetUnhandledExceptionFilter InitializeSListHead SetConsoleTextAttribute WriteProcessMemory DeleteFileA GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter

user32

MoveWindow SetWindowLongW GetWindowLongW

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteExA

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset __current_exception __current_exception_context __C_specific_handler __std_exception_destroy _CxxThrowException __std_terminate memcmp __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _initterm_e _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment system _beginthreadex _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv exit _get_initial_narrow_environment _set_app_type _initterm

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale