loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 3.4MB
Sample260807-jythhazfrb
SHA256 e89e2a05d4d3695a75beab6887212df4a4acb2e602d75a0b4a6e8af0aa1ed5b5
MD5 976eb1a6d4a31c3f4c2076cf8ba0e4da
SHA1 edc8222ca9779280923e3288e95aabc29bd20266
SHA512 0c564f4facf3c21ac9e0fa2417c0c4d1d4e7b8f58c05cb4a552c04a9cd905c5cfd747f47da5c681693bf503276526168a49e94b212a703273f42a215a7caa1cd
SSDEEP 49152:PvSWifeAbPWMtocfBRewb9ORtTghNxACgIfUXAxP4UylBW9ezIU6i7fnhN:enZRPb9KshTB+7
TLSH
T14FF58C42F6A240EAC17AC174D356A533FB727C89073576EB16E046353E62BD0AB3EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 3.4MB

loader.exe

IMPHASH 9a881dce9aa27328cbeb95ccd9a28d77
SHA256 e89e2a05d4d3695a75beab6887212df4a4acb2e602d75a0b4a6e8af0aa1ed5b5
MD5 976eb1a6d4a31c3f4c2076cf8ba0e4da
SHA1 edc8222ca9779280923e3288e95aabc29bd20266
SHA512 0c564f4facf3c21ac9e0fa2417c0c4d1d4e7b8f58c05cb4a552c04a9cd905c5cfd747f47da5c681693bf503276526168a49e94b212a703273f42a215a7caa1cd
SSDEEP 49152:PvSWifeAbPWMtocfBRewb9ORtTghNxACgIfUXAxP4UylBW9ezIU6i7fnhN:enZRPb9KshTB+7
TLSH
T14FF58C42F6A240EAC17AC174D356A533FB727C89073576EB16E046353E62BD0AB3EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2429352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

loader.pdb

ntdll

NtReadFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlCaptureContext RtlVirtualUnwind NtQuerySystemInformation NtQueryInformationProcess NtWriteFile NtCreateFile

kernel32

AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FreeLibrary GetFileAttributesW GetProcessIoCounters GetSystemTimes AcquireSRWLockShared GetProcessTimes GetSystemTimePreciseAsFileTime FindVolumeClose GetModuleHandleW FindNextVolumeW FindFirstVolumeW DeviceIoControl GetDiskFreeSpaceExW GetVolumePathNamesForVolumeNameW GetVolumeInformationW GetDriveTypeW FindNextFileW CopyFileExW DeleteFileW GetTempPathW GetUserDefaultUILanguage LCIDToLocaleName ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle HeapReAlloc FindFirstFileExW SetFileInformationByHandle IsDebuggerPresent CheckRemoteDebuggerPresent LoadLibraryW GetTickCount64 CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualAllocEx WriteProcessMemory VirtualFreeEx Module32FirstW Module32NextW InitOnceExecuteOnce SetFileTime TlsAlloc CreateFileW GetSystemInfo RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar FormatMessageW GlobalMemoryStatusEx ReadProcessMemory VirtualQueryEx GetFullPathNameW SetHandleInformation ReleaseMutex CreateMutexA WaitForSingleObjectEx GetFinalPathNameByHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx SetWaitableTimer CreateWaitableTimerExW GetCurrentThread SetThreadStackGuarantee CreateRemoteThread OpenProcess GetCurrentProcess WaitForSingleObject MoveFileExW GetCurrentProcessId SetLastError WakeAllConditionVariable SleepConditionVariableSRW LocalFree TerminateProcess TlsGetValue PostQueuedCompletionStatus IsProcessorFeaturePresent SwitchToThread FindClose GetCurrentThreadId GetSystemTimeAsFileTime CreateThread GetModuleHandleA LoadLibraryExA Sleep GetProcAddress CloseHandle GetLastError TlsSetValue GetProcessHeap OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW HeapAlloc HeapFree SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler K32GetPerformanceInfo GetCurrentDirectoryW GetEnvironmentVariableW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW

bcryptprimitives

ProcessPrng

oleaut32

SafeArrayAccessData SetErrorInfo SafeArrayUnaccessData SysFreeString SysStringLen GetErrorInfo SafeArrayDestroy VariantClear SysAllocStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

WSASend freeaddrinfo bind getaddrinfo getsockopt WSAGetLastError WSACleanup connect ioctlsocket WSASocketW setsockopt recv closesocket send WSAIoctl WSAStartup

advapi32

RegOpenKeyExW CopySid RegQueryValueExW IsValidSid GetLengthSid OpenProcessToken RegCloseKey RegGetValueW GetTokenInformation EventUnregister EventRegister EventSetInformation EventWriteTransfer

user32

GetKeyboardLayout MapVirtualKeyExW RegisterWindowMessageA ShowWindow GetSystemMenu EnableMenuItem InvalidateRgn EnumChildWindows IsProcessDPIAware GetDC DispatchMessageA GetMessageA SetWindowPos RegisterClassExW RegisterRawInputDevices SetWindowLongW RegisterTouchWindow IsWindow MonitorFromPoint CreateWindowExW MessageBoxW DestroyIcon ChangeDisplaySettingsExW SetForegroundWindow GetForegroundWindow CreateIcon SetCursor LoadCursorW GetActiveWindow CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient SetWindowPlacement GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData DefWindowProcW GetKeyboardState GetAsyncKeyState RedrawWindow SetWindowLongPtrW GetKeyState MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW SendMessageW DestroyWindow PostMessageW GetWindowLongPtrW ShowCursor DispatchMessageW TranslateMessage GetMessageW GetClipCursor ClipCursor GetMenu AdjustWindowRectEx GetWindowRect ToUnicodeEx SetFocus GetWindow GetWindowPlacement SystemParametersInfoA SetPropW SendInput

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ole32

CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket RevokeDragDrop CoUninitialize RegisterDragDrop OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance

gdi32

CreateSolidBrush GetDeviceCaps DeleteObject

shell32

SHAppBarMessage DragFinish DragQueryFileW CommandLineToArgvW

shlwapi

SHCreateMemStream

crypt32

CryptProtectData CryptUnprotectData

dwmapi

DwmSetWindowAttribute

iphlpapi

GetAdaptersAddresses

pdh

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhOpenQueryA

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

__current_exception __C_specific_handler memchr __std_exception_copy strchr _CxxThrowException __std_exception_destroy _purecall memset memcpy memcmp memmove __current_exception_context __CxxFrameHandler3 wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

roundf floor __setusermatherr round pow trunc

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp wcslen strcmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol strtol

api-ms-win-crt-runtime-l1-1-0

abort exit _exit _initterm _get_initial_narrow_environment __p___argv _initterm_e _cexit _register_onexit_function _initialize_onexit_table _c_exit _initialize_narrow_environment terminate _wassert _seh_filter_exe _register_thread_local_exe_atexit_callback _errno _crt_atexit _set_app_type _configure_narrow_argv __p___argc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

ferror fseek fgets fopen __stdio_common_vsscanf __p__commode feof _setmode _set_fmode __stdio_common_vfprintf fflush __acrt_iob_func fclose _fileno fwrite fread ftell __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale