Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 2.2MB
Sample260816-lbd6eathpf
SHA256 d75de0f2630a90a46d5329a35a37c06c8d0bc7277be82ace5d8e5a5cc5dc7d8e
MD5 0bfebbbbe27efccfd8fcbeb58b3a46c4
SHA1 46997fe3d7a59a065c5f4074ed0ce48617a7bed2
SHA512 f16f0d16825c786441d2f19cbe6bcbb59e413ce59782c4d5dcd156121217a76402e2f0cd94660f437263aa8c3c69d0a3e34c40a00e4494082f4542406eaac1f0
SSDEEP 24576:6zZvI/0ye07YsJrxQ5XfnRu2kZAhJXfeWCTLpXph+eDBkTlqQ28HZ5pisAPUN/nj:6/+1S5X1wwuL1uqkHaSnIn
TLSH
T158B5BF4BF39296EEE1677438C492A3139B717C15573147CB33895826EFA72E09EBA340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 2.2MB

Loader.exe

IMPHASH d1418b426a4f97b79f9fd6aa8cd7a50c
SHA256 d75de0f2630a90a46d5329a35a37c06c8d0bc7277be82ace5d8e5a5cc5dc7d8e
MD5 0bfebbbbe27efccfd8fcbeb58b3a46c4
SHA1 46997fe3d7a59a065c5f4074ed0ce48617a7bed2
SHA512 f16f0d16825c786441d2f19cbe6bcbb59e413ce59782c4d5dcd156121217a76402e2f0cd94660f437263aa8c3c69d0a3e34c40a00e4494082f4542406eaac1f0
SSDEEP 24576:6zZvI/0ye07YsJrxQ5XfnRu2kZAhJXfeWCTLpXph+eDBkTlqQ28HZ5pisAPUN/nj:6/+1S5X1wwuL1uqkHaSnIn
TLSH
T158B5BF4BF39296EEE1677438C492A3139B717C15573147CB33895826EFA72E09EBA340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Combat-Master-Internal-main\Injector\x64\Release\Y8X-Injector.pdb

d3d11

D3D11CreateDeviceAndSwapChain

shell32

SHGetFolderPathA ShellExecuteA

kernel32

GetProcAddress VirtualAllocEx FreeLibrary CreateRemoteThread Module32NextW VirtualFreeEx MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID OpenProcess GetLocaleInfoW LCMapStringW Module32FirstW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle CloseHandle Process32FirstW LoadLibraryA Process32NextW GetModuleHandleA WaitForSingleObject WriteProcessMemory CreateFileW HeapSize WriteConsoleW SetEndOfFile GetModuleFileNameW TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetTempPathA Sleep GetExitCodeThread CreateToolhelp32Snapshot IsValidLocale FindNextFileW CreateThread FlsFree FlsSetValue FlsGetValue LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW RtlUnwind GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc

user32

ReleaseCapture UpdateWindow PostQuitMessage SetCapture LoadCursorW TranslateMessage MessageBoxA PeekMessageW ClientToScreen DispatchMessageW ShowWindow GetKeyState ScreenToClient GetCapture TrackMouseEvent GetForegroundWindow SetCursor GetClientRect IsWindowUnicode SetCursorPos GetCursorPos OpenClipboard RegisterClassExW EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW PostMessageW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW CloseClipboard

advapi32

CheckTokenMembership RegCloseKey RegQueryValueExA AllocateAndInitializeSid FreeSid RegOpenKeyExA

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

454KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

d3d11

shell32

kernel32

user32

advapi32

winhttp

imm32

d3dcompiler_47

generic