loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 2.2MB
Sample260720-mtltmshx4v
SHA256 d92caaecca7f0e88be94dffbba452335854ae95f43db48d187aa492b1558a6b6
MD5 5a5c0bc48256c4501648ba97c37a47de
SHA1 eee4993e4b4c25f1daaab4318be19089070d0d55
SHA512 540c0c1ab26eb6f27b612e86703c5cb2654adc87289610e8345b775c06223c68391108052c50cebdf859a8029398d92b8df74f0ce763d8fd05b27f84b2657ee1
SSDEEP 49152:xZKnHryvnpthxsptswphVOHS5YYdEfV7Fni:b+EY
TLSH
T17BB5E81576EA14A0C1AAC079E9079767CD30704A133D51FF979589C46FB03E8AAFCFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 2.2MB

loader.exe

IMPHASH 8f9a028656284079c10c67a46d1c1e7d
SHA256 d92caaecca7f0e88be94dffbba452335854ae95f43db48d187aa492b1558a6b6
MD5 5a5c0bc48256c4501648ba97c37a47de
SHA1 eee4993e4b4c25f1daaab4318be19089070d0d55
SHA512 540c0c1ab26eb6f27b612e86703c5cb2654adc87289610e8345b775c06223c68391108052c50cebdf859a8029398d92b8df74f0ce763d8fd05b27f84b2657ee1
SSDEEP 49152:xZKnHryvnpthxsptswphVOHS5YYdEfV7Fni:b+EY
TLSH
T17BB5E81576EA14A0C1AAC079E9079767CD30704A133D51FF979589C46FB03E8AAFCFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

824524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\loader\x64\Debug\loader.pdb

kernel32

GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetModuleHandleW IsDebuggerPresent GetCurrentProcess GetCurrentThread GetThreadContext TerminateProcess GetProcessHeap HeapFree HeapAlloc GlobalFree QueryPerformanceFrequency GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW RaiseException SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery GlobalLock GlobalUnlock FreeLibrary QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte InitializeSListHead MultiByteToWideChar GlobalAlloc GetLastError OutputDebugStringA

user32

GetForegroundWindow GetWindowLongPtrW TranslateMessage SetProcessDPIAware MonitorFromWindow DispatchMessageW SetWindowLongPtrW UpdateWindow GetSystemMetrics ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect SetWindowPos OpenClipboard CloseClipboard SetClipboardData GetClipboardData ShowWindow DestroyWindow CreateWindowExW PeekMessageW RegisterClassExW UnregisterClassW PostQuitMessage LoadCursorW EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo DefWindowProcW GetKeyState IsWindowUnicode ReleaseCapture SetCapture ReleaseDC GetCapture GetDC

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

msvcp140d

?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_counter

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

vcruntime140d

memmove __std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler __current_exception __current_exception_context strchr __std_type_info_destroy_list __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy memcmp memchr __C_specific_handler_noexcept memset strstr

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

fabs ceilf cosf fmodf sqrtf strcpy strncmp toupper floorf powf sinf acosf atof log pow atan2f logf _invoke_watson _CrtDbgReport _CrtDbgReportW terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table __stdio_common_vfprintf _crt_at_quick_exit malloc _callnewh _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _free_dbg strcpy_s strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s wcscpy_s _wassert strncpy strlen strcmp ftell fseek fread qsort free __stdio_common_vsscanf _cexit fflush fclose __stdio_common_vsprintf _wfopen _crt_atexit __acrt_iob_func fwrite

Name

.textbss

Size

Virtual Size

789KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

490KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

user32

gdi32

shell32

imm32

d3dcompiler_47

dwmapi

msvcp140d

d3d11

ntdll

vcruntime140d

vcruntime140_1d

ucrtbased

generic