loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 3.8MB
Sample260804-rmtccssemc
SHA256 ae060fa78262ae74029b3ca013adb10af9da4b6b65268691ac7d4d16f4c6d4a8
MD5 8d04a00bc3e8e10a8bc6d94f4b5474f3
SHA1 dc16b864b14e48409e48e32f038240c449ac85fc
SHA512 d0acae4943698e179f36e63a384e65e9dbfd132f07081a5f6db5a2647a84b45e21f2c66361760c332b18377113e13d240e9bb2d879512bef8a15971dca1497c4
SSDEEP 49152:pjUcC+FlCdRRyzrUn1Z+ELlcvlXE9cvlXEDiNTQO5SgX0K7I69q:prl8nyzYZQlxl8iNUiE2Dq
TLSH
T1D406BF47D3995FABD07924344A03A1079EE1B811237AC6DFE693992B6217BF41D3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 3.8MB

loader.exe

IMPHASH 358fd3e2811c8bf35204ed467f8c44de
SHA256 ae060fa78262ae74029b3ca013adb10af9da4b6b65268691ac7d4d16f4c6d4a8
MD5 8d04a00bc3e8e10a8bc6d94f4b5474f3
SHA1 dc16b864b14e48409e48e32f038240c449ac85fc
SHA512 d0acae4943698e179f36e63a384e65e9dbfd132f07081a5f6db5a2647a84b45e21f2c66361760c332b18377113e13d240e9bb2d879512bef8a15971dca1497c4
SSDEEP 49152:pjUcC+FlCdRRyzrUn1Z+ELlcvlXE9cvlXEDiNTQO5SgX0K7I69q:prl8nyzYZQlxl8iNUiE2Dq
TLSH
T1D406BF47D3995FABD07924344A03A1079EE1B811237AC6DFE693992B6217BF41D3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

889976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Car23\Downloads\FairGame Permanent Spoofer\x64\Release\loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetProcAddress GlobalLock ExitProcess GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter GetTickCount GlobalUnlock VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter TerminateProcess OpenProcess Sleep MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA FreeLibrary VirtualFree VirtualAlloc GetCurrentThreadId DeviceIoControl CreateFileW GetTempPathW IsProcessorFeaturePresent K32GetModuleInformation GlobalFree GetThreadContext Process32FirstW GlobalAlloc QueryPerformanceFrequency LoadLibraryA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead LoadLibraryExA ReleaseSRWLockExclusive ReadFile UnhandledExceptionFilter WriteFile GetTempPathA CreateFileA CloseHandle GetModuleFileNameA GetCurrentProcess OutputDebugStringA SetThreadPriority GetModuleHandleA CreateToolhelp32Snapshot GetModuleHandleExA Process32NextW GetCurrentThread

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent SetWindowPos GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor ShowWindow IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetClipboardData DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW OpenClipboard DispatchMessageW GetClientRect GetWindowRect AdjustWindowRectEx GetWindowLongW UpdateWindow PostQuitMessage SetClipboardData TranslateMessage SetLayeredWindowAttributes MessageBoxA PeekMessageW EmptyClipboard CloseClipboard

advapi32

CryptGetHashParam RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegCloseKey CryptAcquireContextW RegQueryValueExA CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExA CryptReleaseContext

shell32

ShellExecuteW

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??Bid@locale@std@@QEAA_KXZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Mtx_lock _Mtx_unlock ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

urlmon

URLDownloadToFileA

vmprotectsdk64

VMProtectBeginMutation VMProtectIsVirtualMachinePresent VMProtectBeginVirtualization VMProtectBeginUltra VMProtectBegin VMProtectIsDebuggerPresent VMProtectIsValidImageCRC VMProtectEnd

ntdll

RtlInitUnicodeString RtlCaptureContext NtQuerySystemInformation RtlAdjustPrivilege NtLoadDriver RtlLookupFunctionEntry NtUnloadDriver RtlVirtualUnwind

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _set_purecall_handler strstr wcsstr strrchr __std_exception_copy strchr longjmp memcpy _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove __std_terminate

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line signal _set_app_type _seh_filter_exe _initterm_e _initterm _invalid_parameter_noinfo_noreturn terminate _cexit _crt_atexit exit set_terminate _register_onexit_function _invoke_watson _initialize_onexit_table _initialize_narrow_environment _set_invalid_parameter_handler _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_abort_behavior _c_exit _exit _errno

api-ms-win-crt-string-l1-1-0

_stricmp isspace _wcsicmp strncpy strcmp strncpy_s strncmp

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fsetpos fopen __stdio_common_vsprintf_s ungetc setvbuf fgetpos __p__commode fgetc fputc __stdio_common_vsprintf __stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush ftell __acrt_iob_func _fseeki64 _set_fmode

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wremove _lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sinf pow powf __setusermatherr acosf sqrtf fmodf ceilf cosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

bcrypt

BCryptHashData BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptCloseAlgorithmProvider