ExLoader_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.exe
Size 173KB
Sample260816-lmsg6svsgw
SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
MD5 0572dd0c0fd63a372a10f14f5f981c59
SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
TLSH
T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExLoader_Installer.exe

File Explorer

ExLoader_Installer.exe

.exe 173KB

ExLoader_Installer.exe

IMPHASH 7a19fef12551d8786d0322bc83732bc7
SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
MD5 0572dd0c0fd63a372a10f14f5f981c59
SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
TLSH
T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

kernel32

IsDebuggerPresent LoadLibraryW AttachConsole GetCommandLineW LocalFree WideCharToMultiByte AllocConsole FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA SetUnhandledExceptionFilter GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA QueryPerformanceCounter GetCurrentProcessId GetStartupInfoW GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException

user32

SetWindowPos MoveWindow ShowWindow DestroyWindow IsIconic GetMonitorInfoW MonitorFromPoint LoadIconW LoadCursorW SetParent SetWindowLongPtrW GetWindowLongPtrW GetWindowRect GetClientRect SetForegroundWindow SetFocus CreateWindowExW UnregisterClassW LoadStringW GetMessageW IsWindowVisible TranslateMessage DispatchMessageW MessageBoxW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx

advapi32

RegGetValueW

msvcp140

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_exception_destroy _CxxThrowException __current_exception __C_specific_handler memcmp __std_type_info_compare memset memcpy __current_exception_context __std_terminate

api-ms-win-crt-string-l1-1-0

wcslen strlen wcsnlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func _dup2 freopen_s _fileno __p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _initterm terminate _cexit _initialize_onexit_table _register_onexit_function _crt_atexit _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _exit _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale