AnoklesLoader[.]exe

Resubmissions

15/08/2026, 19:45

260815-ygjdjasfpg

15/08/2026, 19:44

260815-yf2hqattbs3

Sharing

Copy URL Twitter E-mail

General

Target
AnoklesLoader.exe
Size 3.5MB
Sample260815-ygjdjasfpg
SHA256 1c42194553671707b267873e98eee889af483aa1a808685b45fe0e982fc8b1af
MD5 3487d44f05be60d6bd34c6a79802922a
SHA1 a5b3e802ebea324e38357ea1b9e0a2cbfc9d6b7f
SHA512 6b1307c6f0bd990cee7052f6c91812b3fc4526e95a1e3de1f7f34300264d29d34c3e59952c3459cb89f94e9f0f92531cf4a0b1d5434bed280ced4096f22a2380
SSDEEP 98304:Peng9NrlBvDCsea1gTz8cE3XaiMghvIQLf:PBhc3a1gTz873XaiMgh
TLSH
T1B006D142F3D599EEC42AAA3491D7272FB734F8900B3246CB536056346FA36E08D7BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AnoklesLoader.exe

File Explorer

AnoklesLoader.exe

.exe 3.5MB

AnoklesLoader.exe

IMPHASH edb9a6732f721c65fecd7ba24a85b759
SHA256 1c42194553671707b267873e98eee889af483aa1a808685b45fe0e982fc8b1af
MD5 3487d44f05be60d6bd34c6a79802922a
SHA1 a5b3e802ebea324e38357ea1b9e0a2cbfc9d6b7f
SHA512 6b1307c6f0bd990cee7052f6c91812b3fc4526e95a1e3de1f7f34300264d29d34c3e59952c3459cb89f94e9f0f92531cf4a0b1d5434bed280ced4096f22a2380
SSDEEP 98304:Peng9NrlBvDCsea1gTz8cE3XaiMghvIQLf:PBhc3a1gTz873XaiMgh
TLSH
T1B006D142F3D599EEC42AAA3491D7272FB734F8900B3246CB536056346FA36E08D7BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowLongW GetWindowRect IsWindowUnicode LoadCursorW LoadIconW MonitorFromWindow MoveWindow OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetWindowLongA ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

winmm

PlaySoundW

d3d11

D3D11CreateDeviceAndSwapChain

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmIsCompositionEnabled

d3dcompiler_47

D3DCompile

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf _fileno _setmode _wfopen fclose fflush fputc fputwc fread fseek ftell fwrite setvbuf

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler _wassert abort exit strerror strerror_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf ceilf cosf fmodf log logf pow powf sinf sqrtf

api-ms-win-crt-convert-l1-1-0

atof mbrtowc strtof strtol strtoll strtoul strtoull wcrtomb wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp strncpy strnlen wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

GetTokenInformation OpenProcessToken

kernel32

AcquireSRWLockExclusive CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateProcessW DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FormatMessageA FreeLibrary GetActiveProcessorCount GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadContext GetThreadId GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA LocalFree MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

918KB

Virtual Size

917KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

AnoklesLoader.exe

gdi32

user32

winmm

d3d11

shell32

ole32

dwmapi

d3dcompiler_47

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic