loader (3)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader (3).exe
Size 4.3MB
Sample260727-wp177scc72
SHA256 a4839e80e15a4e8d3276b3a212c10d3595e50b1b93b2e7e90ce83f0b28e7dee6
MD5 2af227ee7eed33799544afcb35ba87f6
SHA1 2c0e88db85cb4ea3949a3ca1402a58ac1bbf8c88
SHA512 b713672e0e47b8fc574b354d470774daa8cdcfe20db72ae40380612020e712c09d278df01cd184d677bd69d4066775683a27d12975565da088551bc7084bbf7d
SSDEEP 98304:qsNo/Y7mgTm05AwJHE6h9RxhQY2M7y1ePuPnNOTQYN:q1g7PAmkuh375uPATHN
TLSH
T1EE26F00AF3924AAFD3A6A238C995D713D7773408472247FB2BC855189EC6AF04E3D791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader (3).exe

File Explorer

loader (3).exe

.exe 4.3MB

loader (3).exe

IMPHASH e26580a024741577392a679daf91145f
SHA256 a4839e80e15a4e8d3276b3a212c10d3595e50b1b93b2e7e90ce83f0b28e7dee6
MD5 2af227ee7eed33799544afcb35ba87f6
SHA1 2c0e88db85cb4ea3949a3ca1402a58ac1bbf8c88
SHA512 b713672e0e47b8fc574b354d470774daa8cdcfe20db72ae40380612020e712c09d278df01cd184d677bd69d4066775683a27d12975565da088551bc7084bbf7d
SSDEEP 98304:qsNo/Y7mgTm05AwJHE6h9RxhQY2M7y1ePuPnNOTQYN:q1g7PAmkuh375uPATHN
TLSH
T1EE26F00AF3924AAFD3A6A238C995D713D7773408472247FB2BC855189EC6AF04E3D791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

683888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfoEx2 CryptUnprotectData CryptProtectData

ws2_32

ntohs setsockopt getnameinfo ioctlsocket freeaddrinfo WSACleanup closesocket shutdown WSASocketW getaddrinfo WSAStartup getpeername getsockname send socket WSAPoll connect recv getsockopt WSAGetLastError

advapi32

RegCloseKey GetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW

user32

SetClipboardData GetClipboardData PostQuitMessage GetActiveWindow MessageBoxW SetCursor ShowWindow EmptyClipboard GetRawInputDeviceInfoW RegisterClassW GetRawInputData RegisterRawInputDevices wsprintfW DefWindowProcW MonitorFromPoint GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW GetMonitorInfoW DispatchMessageW PeekMessageW TranslateMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture CloseClipboard GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard

shell32

SHGetFolderPathW ShellExecuteW

kernel32

GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapReAlloc GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetFileInformationByHandleEx ReadConsoleW MoveFileExW AreFileApisANSI ReadFile FindFirstFileW FindNextFileW GetEnvironmentVariableW FindClose CreateFileW MultiByteToWideChar CloseHandle GetProcAddress LocalFree GetFileSize ExitProcess GetModuleHandleW GetSystemFirmwareTable GetVolumeInformationW DeviceIoControl GlobalMemoryStatusEx WideCharToMultiByte GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetCurrentProcess LoadLibraryW WriteFile GetTempPathW GetEnvironmentVariableA UnmapViewOfFile Sleep GetTickCount64 GetLastError CreateFileA DeleteFileW CreateFileMappingA CreateProcessW CreateDirectoryA MapViewOfFile GetTickCount CreateFile2 SetStdHandle RtlUnwind HeapSize WriteConsoleW GetFileSizeEx SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx GetConsoleOutputCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage SetEndOfFile EncodePointer FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW

gdi32

CreateRoundRectRgn

setupapi

CM_Get_Device_IDW SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoListExW SetupDiOpenDeviceInfoW SetupDiGetClassDevsW CM_Get_Parent SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsW

iphlpapi

GetAdaptersAddresses

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

880KB

Virtual Size

879KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

968KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

loader (3).exe

d3d11

bcrypt

crypt32

ws2_32

advapi32

user32

shell32

kernel32

gdi32

setupapi

iphlpapi

imm32

d3dcompiler_47

generic