ExLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader.exe
Size 201KB
Sample260810-2wjjmabl7x
SHA256 f66c1efad95e723ecb9f1d35846aa46b6ebfc5a74b4293dd95e268ac07c6c196
MD5 02fa1f7d2b3568975512b054c32d6dc9
SHA1 c19bb7b4df37e03770b9babeedebcffd79903ee1
SHA512 aab32df022da3c506373e7f13caac74c922b285d0d66c087605bb31b5ce84ff1b8c801ff8838c9c26f64f742a18462f77871b0dbc20b4e3fe86ec4d71778302f
SSDEEP 3072:eM+Ytzin7g4OU+O1NQtLbU/5YZjtHx6hVzZuZqv8PwKreqbpmiY0UG:eM+6in7jOU+O1NQ1AuAhVIZxwKreqB
TLSH
T1FA14D015FF16008BD2094E74D8538E09EA72F88E5BF196CBB7405EDA6E375C4AF3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExLoader.exe

File Explorer

ExLoader.exe

.exe 201KB

ExLoader.exe

IMPHASH 685f706e2de3f506be9160627efcdbef
SHA256 f66c1efad95e723ecb9f1d35846aa46b6ebfc5a74b4293dd95e268ac07c6c196
MD5 02fa1f7d2b3568975512b054c32d6dc9
SHA1 c19bb7b4df37e03770b9babeedebcffd79903ee1
SHA512 aab32df022da3c506373e7f13caac74c922b285d0d66c087605bb31b5ce84ff1b8c801ff8838c9c26f64f742a18462f77871b0dbc20b4e3fe86ec4d71778302f
SSDEEP 3072:eM+Ytzin7g4OU+O1NQtLbU/5YZjtHx6hVzZuZqv8PwKreqbpmiY0UG:eM+6in7jOU+O1NQ1AuAhVIZxwKreqB
TLSH
T1FA14D015FF16008BD2094E74D8538E09EA72F88E5BF196CBB7405EDA6E375C4AF3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

flutter_windows

FlutterDesktopViewControllerForceRedraw FlutterDesktopViewGetHWND FlutterDesktopResyncOutputStreams FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopMessengerAddRef FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopViewControllerGetView FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopViewControllerDestroy FlutterDesktopViewControllerCreate FlutterDesktopEngineSetNextFrameCallback FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineDestroy FlutterDesktopEngineCreate FlutterDesktopGetDpiForMonitor

kernel32

InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException LoadLibraryA GetProcAddress GetModuleHandleW FreeLibrary AllocConsole WideCharToMultiByte LocalFree GetStartupInfoW GetCommandLineW AttachConsole IsDebuggerPresent

user32

ShowWindow MoveWindow SetWindowPos IsWindowVisible IsIconic SetFocus SetForegroundWindow GetClientRect DestroyWindow GetWindowLongPtrW SetWindowLongPtrW SetParent LoadCursorW LoadIconW MonitorFromPoint GetMonitorInfoW GetMessageW CreateWindowExW GetWindowRect UnregisterClassW TranslateMessage DispatchMessageW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoUninitialize

advapi32

RegGetValueW

msvcp140

?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xlength_error@std@@YAXPEBD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __current_exception_context __current_exception __C_specific_handler memcmp __std_type_info_compare __std_terminate memset memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen wcslen strlen

api-ms-win-crt-stdio-l1-1-0

_dup2 __p__commode _fileno freopen_s _set_fmode __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _cexit terminate exit _crt_atexit _register_thread_local_exe_atexit_callback _initterm_e _exit _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _c_exit _seh_filter_exe _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale