loader_v9[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader_v9.exe
Size 770KB
Sample260810-raryrsap4w
SHA256 572560fbf9d0be9e1238f772922f6dcfb1cabeb9572e17ac34186a499beb5a14
MD5 06a50b910e8e385c1014e2b6396a7fd0
SHA1 2e8bd109dd7daf60eb78d16b79297a316b31ed69
SHA512 3f3fca748afd01635a4614115ab6e296ab6285fb0fd8baa91fcdc34db2c71f9e4eabd0f7e75f8efc16b3c5649b66c82d91463ce26f5920aea7023c31c3f38049
SSDEEP 24576:9OzJ5EmOknppt7WoxwKxUdNFJSSTxtQVomN:9DmpPxwoCJSSTxtb
TLSH
T118F49D26DA1401B9E067D1B8DA975803FBB2B84803369DFB17D0DAA60F1B5D49B3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader_v9.exe

File Explorer

loader_v9.exe

.exe 770KB

loader_v9.exe

IMPHASH d0192d30d52b449a500cb62c697dc0f2
SHA256 572560fbf9d0be9e1238f772922f6dcfb1cabeb9572e17ac34186a499beb5a14
MD5 06a50b910e8e385c1014e2b6396a7fd0
SHA1 2e8bd109dd7daf60eb78d16b79297a316b31ed69
SHA512 3f3fca748afd01635a4614115ab6e296ab6285fb0fd8baa91fcdc34db2c71f9e4eabd0f7e75f8efc16b3c5649b66c82d91463ce26f5920aea7023c31c3f38049
SSDEEP 24576:9OzJ5EmOknppt7WoxwKxUdNFJSSTxtQVomN:9DmpPxwoCJSSTxtb
TLSH
T118F49D26DA1401B9E067D1B8DA975803FBB2B84803369DFB17D0DAA60F1B5D49B3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

371120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lolar\Desktop\nowy emulator\x64\Release\loader.pdb

kernel32

GetEnvironmentVariableA CreateMutexA CreateFileW GetFileAttributesW GetSystemDirectoryW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW CreateFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle Beep GlobalLock SetFilePointerEx CreateFileMappingA LocalFree ExitProcess GetModuleHandleW GetConsoleWindow GetSystemTime SetConsoleCursorPosition GlobalUnlock SetConsoleTitleW ConnectNamedPipe FlushFileBuffers GetExitCodeProcess WriteFile OutputDebugStringW GetCurrentProcessId CreateEventW SetEvent GetModuleFileNameW SetUnhandledExceptionFilter GetStdHandle ReleaseSRWLockExclusive SetConsoleTextAttribute GetFileSizeEx GetVolumeInformationW SetConsoleCtrlHandler ReadFile AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime CreateNamedPipeW DeviceIoControl OutputDebugStringA InitializeSListHead

user32

EndPaint BeginPaint InvalidateRect SetForegroundWindow UpdateWindow PostQuitMessage KillTimer GetKeyNameTextW OpenClipboard SetTimer GetMessageW DefWindowProcW UnregisterHotKey GetKeyState MapVirtualKeyW IsWindowVisible SetWindowPos SetWindowRgn CreateWindowExW CallNextHookEx GetSystemMetrics GetAsyncKeyState ShowWindow GetClientRect DispatchMessageW CloseClipboard EmptyClipboard RegisterClassW SetWindowDisplayAffinity RegisterHotKey UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage SetCursor SetClipboardData SetWindowsHookExW GetClipboardData RegisterClassExW

gdi32

SelectObject CreateCompatibleDC GetStockObject CreateRoundRectRgn DeleteDC BitBlt CreateCompatibleBitmap DeleteObject

advapi32

CryptGetHashParam RegQueryValueExW CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash RegCloseKey CryptAcquireContextW RegOpenKeyExW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree CreateStreamOnHGlobal

bcrypt

BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptExportKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptCreateHash BCryptGenRandom

crypt32

CertCreateSelfSignCertificate CertOpenStore CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CryptDecodeObjectEx PFXExportCertStore CertCloseStore CertStrToNameA CryptImportPublicKeyInfoEx2 CertFindCertificateInStore PFXImportCertStore

msvcp140

??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSetOption WinHttpQueryHeaders WinHttpReadData WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse

gdiplus

GdipCreateSolidFill GdipFillPath GdipGraphicsClear GdipDrawLine GdipDrawRectangle GdipFillRectangle GdipClosePathFigure GdipSetPenLineCap197819 GdipCreateFont GdipFree GdipDrawPath GdipDrawString GdipResetWorldTransform GdipCreateFromHDC GdipFillEllipse GdipSetStringFormatLineAlign GdipDrawEllipse GdipGetSolidFillColor GdipRotateWorldTransform GdipCloneBrush GdipAddPathArc GdipCreatePen2 GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetImageWidth GdipTranslateWorldTransform GdipCreateBitmapFromFile GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipCloneImage GdipDrawImageRect GdipCreateFontFamilyFromName GdipGetImageHeight GdipSetTextRenderingHint

ws2_32

bind listen closesocket inet_pton accept WSAGetLastError setsockopt htons htonl recv connect socket send WSAStartup

secur32

EncryptMessage DeleteSecurityContext AcceptSecurityContext InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __RTtypeid strchr __std_terminate wcsrchr __C_specific_handler __RTDynamicCast __std_exception_destroy __std_exception_copy memcpy memmove memset __current_exception __current_exception_context _CxxThrowException __std_type_info_compare

api-ms-win-crt-stdio-l1-1-0

fputc _set_fmode fclose fflush fwrite __stdio_common_vswprintf_s __stdio_common_vsprintf __p__commode _get_stream_buffer_pointers fgetpos setvbuf _fseeki64 __stdio_common_vsprintf_s ungetc fsetpos fread fgetc

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

toupper strcpy_s _wcsicmp isalnum tolower wcscat_s wcslen strlen isprint

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _initialize_onexit_table _set_app_type _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _configure_narrow_argv _seh_filter_exe _errno _register_thread_local_exe_atexit_callback __p___argc _c_exit terminate _beginthreadex __p___argv system _register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtoull strtol

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_collate_cp_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf cosf