Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 20.8MB
Sample260814-a397da1xcs
SHA256 d619de04f11876426944a49980487aad823cfeaa77083efad0ca09567bc223e9
MD5 35350833232f5e379d1d2c7c615d1765
SHA1 820eab4e79d438020e1db58d8e56350322161280
SHA512 9734a71b35032d7bdb5f3bfbd0eb35551e788cd01caba880dfb2be0ca7f05b79c0d6fe0ab15032000639369a21761baf42cc13d08173cd33089d4c63db7c3bbd
SSDEEP 196608:94MjRJjxKY9AGFQnbxEYdSIOTvbfQ6FUKhe5rcQec7sWahFmAIA1p6DgGe/m:KMVuFEY6zbfDFC5rr57sX2AIkV/
TLSH
T1622701093A81DA44F203ED38F0A6A3F864B51E15F0D6B81F17F37CD6B6BA4DD84A2165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 20.8MB

Loader.exe

IMPHASH 3250f67bcaca919b2ff87bd736058c42
SHA256 d619de04f11876426944a49980487aad823cfeaa77083efad0ca09567bc223e9
MD5 35350833232f5e379d1d2c7c615d1765
SHA1 820eab4e79d438020e1db58d8e56350322161280
SHA512 9734a71b35032d7bdb5f3bfbd0eb35551e788cd01caba880dfb2be0ca7f05b79c0d6fe0ab15032000639369a21761baf42cc13d08173cd33089d4c63db7c3bbd
SSDEEP 196608:94MjRJjxKY9AGFQnbxEYdSIOTvbfQ6FUKhe5rcQec7sWahFmAIA1p6DgGe/m:KMVuFEY6zbfDFC5rr57sX2AIkV/
TLSH
T1622701093A81DA44F203ED38F0A6A3F864B51E15F0D6B81F17F37CD6B6BA4DD84A2165
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

479744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daniel\Desktop\Freeze Srcs\Temp Spoofer\ZukisLoader\examples\example_win32_directx11\Release\Loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpSetOption WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpOpenRequest

ntdll

RtlCaptureContext RtlLookupFunctionEntry VerSetConditionMask RtlVirtualUnwind

advapi32

RegCloseKey GetUserNameA RegOpenKeyExA RegQueryValueExA

kernel32

CreateFileW FindClose OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA SizeofResource VirtualProtect GetCurrentProcess TerminateProcess GetEnvironmentVariableA OpenProcess Sleep K32GetModuleFileNameExA QueryFullProcessImageNameA GetCurrentThread GetSystemDirectoryA GetVersionExA CloseHandle GetWindowsDirectoryA FindResourceW K32EnumProcesses FindFirstFileW ExitProcess GetModuleHandleW lstrcmpiA K32EnumProcessModules GetComputerNameA CheckRemoteDebuggerPresent WriteFile GetVolumeInformationA WaitForSingleObject GetTempPathA CreateFileA DeleteFileA GetCurrentProcessId CreateProcessA GetExitCodeProcess FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive AreFileApisANSI GetLastError GetFileInformationByHandleEx FindNextFileW GetFileAttributesExW GetThreadContext

user32

GetDC GetMessageExtraInfo SetProcessDPIAware MonitorFromPoint DestroyWindow GetClientRect GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage UpdateLayeredWindow PostQuitMessage CreateWindowExW IsWindowUnicode SetCapture LoadCursorW ReleaseCapture SetCursorPos ReleaseDC GetCursorPos DefWindowProcW OpenClipboard CloseClipboard GetKeyState EmptyClipboard GetForegroundWindow GetClipboardData SetCursor SetClipboardData GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient UpdateWindow

gdi32

SelectObject DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateDIBSection

shell32

ShellExecuteExA ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Thrd_id _Query_perf_counter ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z _Thrd_join ??1_Locinfo@std@@QEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __std_terminate strstr strchr __std_exception_destroy __std_exception_copy strrchr __current_exception __current_exception_context __C_specific_handler memcpy memcmp memchr memset

api-ms-win-crt-stdio-l1-1-0

fopen_s __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos ftell fgetc __stdio_common_vsprintf_s fflush __p__commode _set_fmode fputc fclose fseek fputs __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp tolower isalnum strncpy_s strncpy strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh realloc free malloc

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _invoke_watson _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _set_app_type _beginthreadex _seh_filter_exe abort terminate _cexit _crt_atexit _errno _register_onexit_function _initialize_onexit_table _initterm _initialize_narrow_environment _configure_narrow_argv _wassert

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_gmtime64_s strftime

api-ms-win-crt-math-l1-1-0

acosf sinf fmodf sqrtf __setusermatherr ceilf cosf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale