loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 219KB
Sample260818-wp32ssyyft
SHA256 1c5adb04f63934bfc76eefa257d985e8e6bafa4c25c0343714a0845e9da6b163
MD5 b2091713ed192c47c6521016c7045054
SHA1 0096b3cd1e5f093be9fcd178d846cd4d6b5c1333
SHA512 da284408e4f88ff97981342f495347a76004519011d0ffe2a20686ad50f69ddab5e7c600462a5797a537f8fbc4b8923fb6083aa39f7f48c9a7b9238eb2e1eb31
SSDEEP 3072:7p24M1nQdMC5iUyRF9JNHmjw3peoH7f6ds3NiTFh9aJMziV2:7p240BJTBrGj/YimEVuV
TLSH
T1C5249D15E7E50CFAE1B78679C9524902EB327C464760DADF03904EA69F27AD08F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 219KB

loader.exe

IMPHASH 0c17229c2dbc24b7e34cf5a83dac3679
SHA256 1c5adb04f63934bfc76eefa257d985e8e6bafa4c25c0343714a0845e9da6b163
MD5 b2091713ed192c47c6521016c7045054
SHA1 0096b3cd1e5f093be9fcd178d846cd4d6b5c1333
SHA512 da284408e4f88ff97981342f495347a76004519011d0ffe2a20686ad50f69ddab5e7c600462a5797a537f8fbc4b8923fb6083aa39f7f48c9a7b9238eb2e1eb31
SSDEEP 3072:7p24M1nQdMC5iUyRF9JNHmjw3peoH7f6ds3NiTFh9aJMziV2:7p240BJTBrGj/YimEVuV
TLSH
T1C5249D15E7E50CFAE1B78679C9524902EB327C464760DADF03904EA69F27AD08F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

FindWindowW GetWindowRect SetForegroundWindow GetAsyncKeyState SetWindowPos

shell32

ShellExecuteExW

advapi32

OpenProcessToken GetTokenInformation

imagehlp

ImageDirectoryEntryToData

wintrust

WinVerifyTrust

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpReadData WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptDecrypt BCryptCreateHash BCryptHashData BCryptEncrypt BCryptFinishHash BCryptDestroyHash

kernel32

HeapReAlloc SetFilePointerEx GetFileSizeEx WriteConsoleW HeapSize RtlPcToFileHeader GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetFileType CreateFileW DeleteFileW GetTempFileNameW SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError Sleep GetCurrentProcess OpenProcess FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW MoveFileExW WideCharToMultiByte SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next K32EnumProcessModulesEx K32GetModuleBaseNameW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess TerminateProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect CompareStringW LCMapStringW

Name

.text

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

user32

shell32

advapi32

imagehlp

wintrust

winhttp

bcrypt

kernel32

generic