loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 24.5MB
Sample260804-c7ktdstycw
SHA256 02504d10fa3bdcadc46a4b8e88cbdbb27a7a50870e5f02f3c4497dd943a5a8b4
MD5 f3a042fc219711ecdf23617e4222e072
SHA1 bc2337f4409811f77d6a23e01d61486054c2879b
SHA512 4ec6580a0acc32b8837bd87c90fdcd9fb3d193710d13ea2d05dfdb0bc9614fe46a7726014d7df88362b67eadbd79b5bd3490b686782d6e04e19d8fdb87782b79
SSDEEP 786432:x0KpabcPjm/l10NzyVxWNKtIIZPE8eAGSPA6AC2:xJnw6zWW2fPE8eAh4y2
TLSH
T1AE4733B678C872D4C4F74A71E28F43A97143A23446E64C0A23D61E01DF21D6BBA5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 24.5MB

loader.exe

IMPHASH 3aa9f8f90e98bc53469fb1db6fb6c00f
SHA256 02504d10fa3bdcadc46a4b8e88cbdbb27a7a50870e5f02f3c4497dd943a5a8b4
MD5 f3a042fc219711ecdf23617e4222e072
SHA1 bc2337f4409811f77d6a23e01d61486054c2879b
SHA512 4ec6580a0acc32b8837bd87c90fdcd9fb3d193710d13ea2d05dfdb0bc9614fe46a7726014d7df88362b67eadbd79b5bd3490b686782d6e04e19d8fdb87782b79
SSDEEP 786432:x0KpabcPjm/l10NzyVxWNKtIIZPE8eAGSPA6AC2:xJnw6zWW2fPE8eAh4y2
TLSH
T1AE4733B678C872D4C4F74A71E28F43A97143A23446E64C0A23D61E01DF21D6BBA5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50069202

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualFree InitializeSListHead

user32

SetWindowLongPtrW IsClipboardFormatAvailable

advapi32

CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorA

ole32

CoInitializeEx

shlwapi

AssocQueryStringW

ws2_32

WSACleanup

oleaut32

SysFreeString

shell32

DragQueryFileW

ntdll

RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle

psapi

EnumDeviceDrivers

d3d11

D3D11CreateDeviceAndSwapChain

winmm

joyGetNumDevs

bcryptprimitives

ProcessPrng

opengl32

wglDeleteContext

gdi32

DescribePixelFormat

crypt32

CertFreeCertificateContext

winhttp

WinHttpReceiveResponse

imm32

ImmSetCandidateWindow

xinput1_4

XInputGetState

comdlg32

CommDlgExtendedError

bcrypt

BCryptGenRandom

dwmapi

DwmSetWindowAttribute

uxtheme

SetWindowTheme

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

vcruntime140

__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

cos

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

24.4MB

Virtual Size

24.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

user32

advapi32

ole32

shlwapi

ws2_32

oleaut32

shell32

ntdll

api-ms-win-core-synch-l1-2-0

psapi

d3d11

winmm

bcryptprimitives

opengl32

gdi32

crypt32

winhttp

imm32

xinput1_4

comdlg32

bcrypt

dwmapi

uxtheme

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic