loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 47KB
Sample260724-rprasagh55
SHA256 c9d86153997b72e83bb81ea045c57c60714c9b8f8063a5ff3ad11281818f977e
MD5 8a6b945b97904489e52ab391e4fe89a6
SHA1 70a55cb9b92e5053f7c3fd49e86a52edf8c580f2
SHA512 86b7d4c9066e63d869d26ab6592499aa3a4e2b2c765df1e1c39c320b085797424af1dc3f110dbe757aae3f2cf1856762bdbac8beaab57181a039f4beeb074acd
SSDEEP 768:Bl7n+RkMJb82jp7AlqFGebYu+NkDFoKcW8mq:Bh+9l82j+lqFosnrq
TLSH
T1A123624FABA500F1C4B9D0BC8192753EF8B174E6436167CF97514A4B1B72BE8A93EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 47KB

loader.exe

IMPHASH 74e73bcdcba78ee68ff5f355dc4e1910
SHA256 c9d86153997b72e83bb81ea045c57c60714c9b8f8063a5ff3ad11281818f977e
MD5 8a6b945b97904489e52ab391e4fe89a6
SHA1 70a55cb9b92e5053f7c3fd49e86a52edf8c580f2
SHA512 86b7d4c9066e63d869d26ab6592499aa3a4e2b2c765df1e1c39c320b085797424af1dc3f110dbe757aae3f2cf1856762bdbac8beaab57181a039f4beeb074acd
SSDEEP 768:Bl7n+RkMJb82jp7AlqFGebYu+NkDFoKcW8mq:Bh+9l82j+lqFosnrq
TLSH
T1A123624FABA500F1C4B9D0BC8192753EF8B174E6436167CF97514A4B1B72BE8A93EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mao\Desktop\123\STALCRAFT-chams\project\build\loader.pdb

kernel32

WriteProcessMemory GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle Module32Next Module32First OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32Next CloseHandle GetConsoleWindow GetModuleHandleW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

user32

GetAsyncKeyState

msvcp140

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memset __std_exception_copy __std_exception_destroy memcmp memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _seh_filter_exe __p___argc __p___argv _set_app_type _initterm_e _exit _invalid_parameter_noinfo_noreturn _beginthreadex _initterm _get_initial_narrow_environment system terminate _configure_narrow_argv _c_exit _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-locale-l1-1-0

_configthreadlocale