loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.1MB
Sample260728-lmz71stdka
SHA256 2712e68440659044e0baf4f7e06f4110ee3c8a67a04c7e321ac0e13b4867dfd5
MD5 02a4278c1a409474e42fec4beb9f6e5c
SHA1 cea5f6f1c734254939351d562dec35187ebd8cc4
SHA512 90d8a9f47e003a439820c9d4844b62ac970bf942d453c7295eadfff633be08f382cddbd6c836ec6276c66385c67c1963d12cd6f31182c97060fcca3d3b123f8b
SSDEEP 24576:PE1OSktjcrJGeyx+NhkKSmmQ42Iq94CLvhL4TqMijnW:PC+cpAAh7qIhCqpjn
TLSH
T17A35A00776A941FCD06BA078E9566A07E735380607A04EEF17D02A663FA76F05F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.1MB

loader.exe

IMPHASH e31e6ba0f7f00a896b60e3120022f997
SHA256 2712e68440659044e0baf4f7e06f4110ee3c8a67a04c7e321ac0e13b4867dfd5
MD5 02a4278c1a409474e42fec4beb9f6e5c
SHA1 cea5f6f1c734254939351d562dec35187ebd8cc4
SHA512 90d8a9f47e003a439820c9d4844b62ac970bf942d453c7295eadfff633be08f382cddbd6c836ec6276c66385c67c1963d12cd6f31182c97060fcca3d3b123f8b
SSDEEP 24576:PE1OSktjcrJGeyx+NhkKSmmQ42Iq94CLvhL4TqMijnW:PC+cpAAh7qIhCqpjn
TLSH
T17A35A00776A941FCD06BA078E9566A07E735380607A04EEF17D02A663FA76F05F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

704024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest

crypt32

CertGetCertificateChain CertFreeCertificateContext CryptStringToBinaryA CertGetNameStringA CertGetCertificateContextProperty CertFreeCertificateChain CryptBinaryToStringA

bcrypt

BCryptVerifySignature BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptDecrypt BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

advapi32

CryptDestroyHash CryptGetHashParam OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CryptAcquireContextW RegQueryValueExA RegCreateKeyExA CryptCreateHash CryptHashData RegSetValueExA CryptReleaseContext

shell32

ShellExecuteW ShellExecuteExA

user32

SetWindowsHookExW GetCursorPos GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW wsprintfA ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage FindWindowW UpdateWindow PostThreadMessageW PostQuitMessage

kernel32

VirtualProtect GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetFileSizeEx GetStdHandle GetModuleFileNameW ExitProcess ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection WriteConsoleW CompareStringW CreateDirectoryW ReadFile GetModuleFileNameA SetHandleInformation HeapFree GetCurrentProcess WriteFile ExpandEnvironmentStringsW TerminateProcess CreateNamedPipeW GetProcessId CreatePipe ExpandEnvironmentStringsA GetEnvironmentVariableA CreateMutexA WaitForSingleObject CreateFileW GetFileAttributesW ReleaseMutex UnmapViewOfFile DisconnectNamedPipe OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError GetFileAttributesA Process32NextW DeleteFileA DeleteFileW Process32FirstW CloseHandle GetSystemInfo CancelIoEx HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress CreateFileMappingA ReadProcessMemory GetCurrentProcessId GetProcessHeap GetModuleHandleW FreeLibrary CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA CreateFileMappingW MapViewOfFile GetTickCount LoadLibraryExW ConnectNamedPipe VirtualQueryEx FlushFileBuffers SetEndOfFile GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter LCMapStringW GetLocaleInfoW CreateProcessW GetExitCodeProcess HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale EnterCriticalSection OutputDebugStringA LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

ole32

CoCreateInstance CoInitializeEx CoUninitialize

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

898KB

Virtual Size

897KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

d3d11

dwmapi

winhttp

crypt32

bcrypt

advapi32

shell32

user32

kernel32

ole32

imm32

d3dcompiler_47

generic