loader[.]exe | Triage™

General

Target
loader.exe
Size 1.1MB
Sample260802-c8gs5acb45
SHA256 ccfde1a9f6ddbffe7727412df12a446f64c938a7a0ffbc05a915644039695fb2
MD5 adb97520f6fbdbadd0d8a823f3df3288
SHA1 874a6144415d7f5f066e87c109d39127f7b50ff1
SHA512 02d43dd1472dd13a1b8a55f9906b2d91b03c93252bd84dba260c1a9921841e173e60d86956c80051e0e97a0da3f34e76ec7990b8ee634b6453422609530cdfbf
SSDEEP 24576:h4QnOsNrVopYm4APGFOYXPxr9Jdqoq4LDkjGJv1xcccK56ynvhvW:RnniYTifwZ9Zqkg6BWK5Lh
TLSH
T19135230993B502F2E2AF813D8AA5050AE7B578394331DFEF02904A965E737D11E79FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.1MB

loader.exe

IMPHASH 494dd68fc7f2069092370ce0c7bbed2c
SHA256 ccfde1a9f6ddbffe7727412df12a446f64c938a7a0ffbc05a915644039695fb2
MD5 adb97520f6fbdbadd0d8a823f3df3288
SHA1 874a6144415d7f5f066e87c109d39127f7b50ff1
SHA512 02d43dd1472dd13a1b8a55f9906b2d91b03c93252bd84dba260c1a9921841e173e60d86956c80051e0e97a0da3f34e76ec7990b8ee634b6453422609530cdfbf
SSDEEP 24576:h4QnOsNrVopYm4APGFOYXPxr9Jdqoq4LDkjGJv1xcccK56ynvhvW:RnniYTifwZ9Zqkg6BWK5Lh
TLSH
T19135230993B502F2E2AF813D8AA5050AE7B578394331DFEF02904A965E737D11E79FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FlushFileBuffers RemoveDirectoryW WriteFile GetTempPathW CloseHandle GetLastError DeleteFileW CreateProcessW GetModuleFileNameW lstrcpyW MoveFileExW WriteConsoleW CreateFileW CreateDirectoryW ExitProcess SetEnvironmentVariableW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer GetStdHandle GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize GetConsoleOutputCP GetConsoleMode

user32

MessageBoxW

advapi32

CryptReleaseContext CryptAcquireContextW CryptGenRandom

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

972KB

Virtual Size

971KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

user32

advapi32

generic